Sealed means sealed — by math, not by promise.
Procurement staff shouldn't have to take “it's encrypted” on faith. Here is exactly how a BiddingSimple sealed bid works, what we can and can't see, and what happens to your data — in plain English.
Every vendor's bid is encrypted in their own browser before it ever leaves their computer. We store only the scrambled result. Until your deadline passes and you open the bids, no one can read them — not other vendors, not your staff, and not us.
How the seal works
Locked at the source
When a vendor submits, their browser encrypts the bid with strong, standard cryptography (the same families that protect online banking). The plain bid never travels the network and never touches our servers.
Stored blind
We receive and store only ciphertext, in a private location. A full copy of our database and file storage would reveal no readable bids and no keys— that's a design goal we hold ourselves to.
Opened on time, together
Submissions are refused after the deadline — enforced on our server's clock, never a vendor's. After it passes, you open every bid at once with your key. Not a moment before.
What's hidden, and what's visible
Sealing protects the contents of a bid. Basic bookkeeping stays visible so the process can run and be audited.
Encrypted — unreadable until you open
- Prices, line items, and totals
- The vendor's proposal, forms, and attachments
- Anything the vendor puts inside their bid
Visible — needed to run the process
- That a vendor submitted, and exactly when (timestamped)
- The solicitation's public details and deadline
- The tamper-evidence fingerprint of each sealed file
The questions procurement always asks
Who holds the key — and what if we lose it?
The keypair is created in your browser; we never see your private key in the clear. To make sure an agency can never be locked out of its own bids, sealing uses a 2-of-3 recovery design: your passphrase, a one-time recovery code we give you to store safely, and a securely-held escrow share. Any two can open the bids — so a forgotten passphrase is recoverable, but no single party (including us) can open them alone.
Could someone open bids early?
No. Opening requires your key andthe deadline to have passed on our server clock. Vendors can't submit late and staff can't peek early — the timing is enforced by the system, not by policy.
How do we prove the process was clean?
Every consequential action — publish, each submission, addenda, the opening — is written to an append-only, hash-chained audit log. Each entry seals the one before it, so a single altered or deleted row is mathematically detectable. At submission we also record a fingerprint (SHA-256) of each sealed file, proving it wasn't swapped. You can export the whole record for your files.
Is this custom crypto we should distrust?
No — and that's deliberate. We use only well-known, audited building blocks (browser Web Crypto plus the widely-reviewed @noble library): RSA-OAEP and AES-GCM for encryption, Argon2id for passphrases, SHA-256 for fingerprints. No home-grown algorithms, no secret sauce.
Where does our data live?
Sealed bids are stored as ciphertext in a private bucket, served only through short-lived, authenticated links. Hosting is in the United States. We never sell data or run third-party ad trackers on your procurement.
What about retention and deletion?
You keep control of your solicitations and their records. Audit entries are intentionally immutable (that's the point of an audit trail), but the sealed bid contents are yours to export and, once an award is closed, to have removed on request.
Run one and see for yourself
Registering your agency is free, and advertising a bid is free. You only pay the flat $95 when you actually run a sealed e-bid — no subscription, no per-vendor fees.
Have a security or compliance question we didn't answer? [email protected]