A BD pipeline holds some of a contractor’s most sensitive information: which opportunities you are chasing, who you are teaming with, why you passed on a pursuit, and what your AI drafts say about your strategy. In October we changed how BiD protects that data. Here is what changed and what it means for you.
Every organization now has its own key
Since October 26, 2026, every organization in BiD has its own encryption key. That key is itself protected by a master key held in a hardware security module, separate from the database. The sensitive fields your team writes (notes, comments, no-bid and loss reasons, AI results, teaming partners and contacts) are encrypted under your organization’s key before they are saved. Since October 27, every file stored in BiD is encrypted the same way: attachments, generated documents, forwarded intake emails and company profile documents.
The practical result: a database backup, an export or a direct database query shows only unreadable text for those fields and files. Public solicitation details (title, agency, NAICS, solicitation number, dates, value and stage) stay unencrypted so you can search and sort your board.
Who can open your key
Your key is opened for signed-in members of your organization, for up to 15 minutes at a time, and for the BiD features that work on your data, such as AI drafting and scheduled scans. BiD’s support tools never receive it, and every use of the key is recorded. Avvyd operates the key service. Enterprise customers who need to control the key themselves can ask about customer-held keys, offered on request.
Isolation, tested in production
Each customer’s data is separated from every other customer’s by row-level security enforced in the database itself. We test that with a repeatable cross-tenant suite that tries to read and change one organization’s data from another. It ran in production on 15 October 2026 with no failures.
You can see when staff access your data
To view anything specific to your organization, a BiD staff member has to open a one-hour support session and give a written reason. Your Owners and Admins are notified, and the session appears in your organization’s Access Log, which cannot be edited or deleted. Since October 14, the database also records every query run by the administrator account. Those records are kept for 7 days today, and longer retention in storage that cannot be edited or deleted is being added.
What we still ask of you
BiD is built for civilian, unclassified business development. Every upload area now reminds users not to upload CUI, classified, ITAR or export-controlled information. If your contract requires a platform for CUI, choose one with a FedRAMP authorization at the level your contract requires.
Read the details
The BiD Security & Trust page lays out every control and its status, and the Sub-processors and AI data use page lists the companies that run BiD, what each can see, and how AI handles your data. Questions about security go to security@avvyd.ai.
Start a free 14-day trial at bid.avvyd.app, no credit card required. New organizations start encrypted.