What we protect, and how

Tenant isolation

Every record in Mandra belongs to exactly one organization — every notice on your list, every decision, every subcontractor, every quote, every pricing sheet and every audit entry. Access is scoped by organization at the query, not by a filter on a screen, and every list and detail endpoint has a test that fetches another organization’s object and asserts it comes back as not found.

The three things that are deliberately shared carry no organization at all: the federal notice as SAM.gov published it, its attachments, and the published NAICS and PSC code lists. A notice is the same public document for every business looking at it.

Our own business is a tenant like any other

Mandra 72nd LLC bids federal work, and it does that on Mandra, in its own organization, under exactly the rules above. No account of ours can open your list, your decisions, your quotes or your pricing from inside the application.

The honest other half: administrators of the production system can reach the database, because somebody has to be able to restore a backup and fix a failed job. That access is for operating the service and for support you have asked for. We do not read customer pricing or decisions for any other purpose, and the application’s own audit trail records what happened to your account either way.

What the AI sees

Solicitation documents are processed by Anthropic’s Claude API, which is what “reads the documents” means. Subcontractor search runs through the same API’s web search, read-only. What is sent is the text of the public solicitation and, for a search, the trade and the place of performance. Your pricing sheet, your quotes and your decisions are never sent to a model.

The model has no tools that take actions. It returns structured fields against a strict schema, and what comes back is validated by our code before it reaches a screen — it is never executed, never rendered as HTML, and never followed as a link. Untrusted text is passed as clearly framed data, and a document that tries to issue instructions to the model is flagged as such on the read.

We have no arrangement with Anthropic under which your documents are used to train models. Anthropic’s own commercial terms govern that processing and we link to them rather than paraphrase them.

Encryption

In transit: every connection to the application and the API is HTTPS, with HTTP redirected and HSTS on. Session cookies are HttpOnly, Secure and SameSite=Lax.

At rest: source credentials stored in the database — such as an API key for a state procurement portal — are encrypted with Fernet using a key held in the environment and never in the database, decrypted only inside the adapter that uses them, and never returned through the API. The database and object storage are encrypted at rest by the platforms that host them; we name the platforms below rather than restating their guarantees in our own words.

Where it runs

The application, the background workers, the database and the Redis instance run on Render in its United States (Ohio) region. Attachments and generated documents are stored in Cloudflare R2. Payments run through Stripe.

Documents

Mandra downloads the attachments a contracting officer posted publicly on SAM.gov, and nothing else. Do not upload controlled documents. Mandra is not an environment for CUI, ITAR or classified material, and nothing in it is built to be.

Attachment files are deleted 30 days after a notice is over, unless you pursued it — in which case they are kept, because a won bid is a contract being performed against those documents and a lost one is the file for the debrief. The text read out of them, and every decision you made, are kept.

Payments

No card details reach Mandra. The card form, the invoices and cancelling are all pages Stripe hosts. What our database stores is a customer id, a subscription id and which price you are on.

The audit trail

Every decision, every gate passed, every link issued and every document read is written to an append-only trail. It cannot be edited or deleted through the API, and an administrator cannot edit it either. It carries what happened, when, and which account did it.

Subcontractor links

A quote link is a single-purpose credential: 32 bytes of randomness, stored only as a hash, good for one notice and one subcontractor, and revocable by you. It expires when the solicitation closes. It grants a public summary of one notice and one upload form — never your pricing, never another sub’s quote, never a list of anything.

Uploads are checked by content rather than by file extension, size-capped, renamed, stored outside the web root and served back only through short-lived signed links. Archives are refused. Repeated invalid attempts lock the link and the address.

Accounts

Passwords are hashed with Django’s defaults and checked against its validators. Every place a secret is checked — sign-in, password reset, email verification, an invitation, a quote link — counts failures per account and per address and locks temporarily after a few, with a cooldown that grows. Never permanently. Two-factor authentication is on the roadmap and is not yet available.

Reporting something

Found a problem? support@mandrabids.com, with “security” in the subject. We answer.