Security and access control

Accounts and approval

• Accounts are created by request or invitation and remain pending until an Administrator approves them.
• Pending, blocked and revoked accounts cannot reach the protected workspace.
• Authentication messages are deliberately generic and do not reveal whether an account exists.
• Password reset links are single-purpose and expire.
• Repeated failed sign-in attempts are rate limited.

Roles and least privilege

• Permissions are granted through roles rather than to individuals, and are checked again on the server for every request.
• Tender contributors reach only the tenders assigned to them, only while contribution is enabled and within any assigned dates.
• Auditors and read-only viewers can see records but cannot change them.
• Only an Administrator can manage users, roles and system settings.
• The application can never be left without an active Administrator.

Data protection

• Row-level security is enabled on protected tables and writes are performed by authorised server functions only.
• Uploaded documents are held in private storage buckets, never on public links, and are reachable only through a permitted request.
• Shared access codes are stored as hashes, never in readable form, and are kept out of logs and analytics.
• Uploaded files are checked for type and size before they are accepted.

Oversight

• Version history preserves earlier states of important records, and released tender versions are immutable.
• Sign-out clears sensitive browser state, and revoking a shared link ends any active session using it.
• Significant actions — approvals, releases, awards, orders, sharing, role changes and settings changes — are recorded permanently with Asia/Muscat timestamps.

Independent review

Security controls are reviewed as part of each build stage. An independent penetration test is recommended before the application is relied upon for live procurement.