Security at BidDeed.AI

Last reviewed: August 2026

No fake badges. Everything below is either directly verifiable (a live endpoint, a public repo file, a database query) or explicitly labeled as in-progress. We don't display compliance marks we haven't earned.

🔒 Data Protection

TLS in transit on every request (Vercel + Cloudflare edge termination).
Encryption at rest on the primary database (Supabase).
Row-Level Security is enabled on 723 of 728 public database tables (99%) — verified by direct query against pg_class.relrowsecurity, August 2026. The remaining tables are reference/lookup data with no customer or credential content.
HTTP security headers (HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy) on every response from this site — Mozilla HTTP Observatory grade C+, up from F before August 2026. Not yet A: our CSP still allows inline scripts for a PostHog snippet that isn't nonce-based yet — tracked as an open item, not hidden.

🔑 Access Control

MCP access uses OAuth 2.1 (WorkOS AuthKit) via RFC 9728 protected-resource discovery, or a scoped bd_live_* API key — both validated server-side on every call.
Secrets are never committed to source. Vault access from any automated agent goes through gated accessor functions with name allow-lists, not direct table reads.
Cloudflare and GitHub deploy tokens are scoped to the minimum permissions and single zone/repo they operate on.

🤖 AI Security

The MCP server's 25 tools run every call through a single canonical pipeline (auth → cert gate → billing → tool handler) — nothing bypasses it.
Pattern-based prompt-injection and secret-leak scanning runs on tool arguments and tool results at that pipeline's single chokepoint.
Every tool response carries an explicit notice: scraped county records and case data are untrusted external data, never instructions.
All 25 tools are billing-gated and idempotency-keyed — a retried or replayed call cannot double-charge or double-execute.

🔍 Audit & Monitoring

Every pull request to this codebase runs an automated security gate: Semgrep SAST, Gitleaks secret scanning, and dependency audit (npm/pip) — CRITICAL/HIGH findings block the merge.
Error monitoring via PostHog (100K events/month free tier) — unhandled exceptions in the Cloudflare Worker are captured server-side and reported, no browser SDK required.
Independent DAST scan (OWASP ZAP) and LLM red-team probing: not yet run against production as of August 2026 — scheduled as a follow-up, pending scope confirmation for live scanning of customer-facing infrastructure.
Known open item: a legacy vault-read database function is more broadly grantable than intended and is flagged internally for tightening — tracked, not hidden.

📋 Compliance Posture

SOC 2 Type I — in preparation, not yet certified.
CASA Tier 2 — planned.
Florida financial/public-record data handling per FS 197.552 and FS 713.07.
Governing law: State of Florida. See our Terms of Service.

📚 Security Documentation

📄 Incident Response Plan — severity classification, detection sources, response playbooks.
📋 Vendor & Sub-Processor List — every third party that touches customer data, with sourced security-page links.
🗓 Data Retention & Deletion Policy — what we keep, for how long, and how to request deletion.
📊 External Scan Results — Mozilla HTTP Observatory (C+, up from F) + SSL Labs (A on TLS), raw output attached.
✅ CAIQ Self-Assessment — CSA-domain-structured control answers, including the gaps, not just the passes.
🤖 AI Security Self-Assessment — prompt-injection controls, model governance, and disclosed AI-specific gaps.
❓ Common Questionnaire Answers — pre-written answers to the 50 questions vendor security reviews ask most.
📦 Request the full Security Evidence Pack (architecture, controls, compliance posture) — email security@biddeed.ai.

🏢 Enterprise Trust Portal

A gated self-serve portal (trust.biddeed.ai, via SafeBase) is in setup — not live yet. Once it launches it will host the documents linked above plus any completed penetration test report, in one request-access location for procurement teams. Until then, use the GitHub links above or email security@biddeed.ai directly — same documents, no waiting on the portal.

📧 Security Contact

Found an issue? Email security@biddeed.ai. We aim to respond within 48 hours. Responsible disclosure is welcome — please give us a reasonable window to fix before public disclosure.