Your pipeline data is your competitive advantage.
Here is exactly how we protect it.
This page describes what is true in BiD's production environment today. Each control is marked Active (live now) or In progress (being built, not yet live). It also explains who at Avvyd can reach your data, how that access is controlled, and how you can see it.
How Your Data is Protected
The controls that keep your organization's data separate from every other organization on BiD. Each one below is active in production.
Tenant Isolation in the Database
Each customer's data is isolated by row-level security enforced in the database, on every application table, not just in application code. We test this with a repeatable cross-tenant test suite that tries to read and change one organization's data from another (last run 25 September 2026, in our staging environment).
Row-level security · TestedPer-Organization File Storage
Uploaded documents are stored privately under per-organization paths that only that organization's members can list, read or change. Files are never publicly accessible; downloads use time-limited signed links.
Private storage · Org-scoped policiesServer Functions Check Identity
Server functions verify the signed-in user and their membership in the organization before reading or writing its data. A request cannot reach another organization's records by naming them.
Identity + membership checksEncryption In Transit & At Rest
Data is encrypted in transit (TLS) on every connection and at rest by our independently certified cloud database and storage provider.
TLS · Encrypted at restSign-In Security
Sign in with Microsoft (Microsoft Entra ID), so your own conditional-access and offboarding policies apply. Multi-factor authentication with an authenticator app is available to every user. Passwords must be at least 12 characters with upper and lower case, a number and a symbol, and passwords known from public breaches are rejected.
Entra ID SSO · MFA · Leaked-password checkServer-Side AI Processing
AI operations run server-side. The AI provider's API key is never exposed to the browser, and our AI provider does not train on API customer data.
Server-side proxy · No trainingEmail Intake Allow-List
Each organization gets its own randomly generated intake address, and emailed opportunities are accepted only from senders your organization approves.
Random addresses · Sender allow-listPayments
Payment card details are handled by our PCI DSS Level 1 payment processor and never stored by BiD. Billing actions are limited to your organization's owners and admins.
PCI DSS Level 1 processorEncryption Under Your Own Keys
On our roadmap: field-level encryption under a separate key for each organization, then customer-held keys (bring your own key) for enterprise customers, and an end-to-end encrypted private vault for a defined set of sensitive fields.
RoadmapStaff Access: Controlled and Visible
Avvyd staff can reach customer data. We say so plainly, and we built the controls so that access is limited, justified in writing, and visible to you.
Named Staff Accounts Only
Avvyd staff tools are limited to named accounts, require multi-factor authentication, and are verified on the server. Access is granted per person, not implied by employment.
Allow-list · MFA · Server-verifiedNo Standing Access
Staff have no standing access to your organization. To view or change anything specific to it, a staff member must open a one-hour support session and state a written reason. Without a session, staff see only a directory of organization names, plans and billing status.
60-minute sessions · Written reasonYou Are Notified
Your organization's owners and admins are notified in BiD every time a support session is opened. The notice is written together with the session itself, so a session cannot open without it.
In-app noticeYour Access Log
Owners and admins can see every action Avvyd staff take on their organization through our support console, with the stated reason, filter it by period, and download it as CSV.
Company Profile · Access LogTamper-Resistant Log
The access log is append-only: the database rejects any edit or deletion of its entries, including by staff.
Append-onlyDatabase-Level Audit Logging
Recording access that happens directly in the database, outside the support console. Running in our staging environment now; production rollout to follow.
Database audit trailEmail Notice of Support Sessions
Today the notice appears inside BiD. We are adding an email to your owners and admins as well.
Email noticeYour Approval Before a Session
An option for your organization to approve a support session before it opens, rather than being notified when it does.
Customer approvalWho Is Behind BiD, and Why It Matters
BiD's customers are government contractors, and so is the company behind it. Here is the relationship, stated up front.
Avvyd is part of Aspis
Avvyd Solutions is a business name of Aspis, LLC (Aspis Consulting), a federal contractor based in Kansas City. BiD was built by Aspis' founder and CEO.
One administrator, with controls
Aspis' CEO is currently BiD's only administrator. No one else at Aspis has administrative access to BiD. That administrator's access is subject to every control in Staff Access: named account, multi-factor authentication, support sessions with a written reason, your notice, and your Access Log.
Aspis is a tenant, like you
Aspis uses BiD for its own pipeline. Its organizations sit in the same production database as every customer and are isolated from yours by the same row-level security and storage controls. Aspis staff who use BiD sign in as ordinary members of Aspis' own organization and have no access path that other customers lack.
Your data runs BiD, nothing else
Customer data is used only to operate the service. That applies to Aspis as much as to anyone. A written information firewall policy, and a no-competitive-use commitment for customer agreements, are being finalized.
Policy in progressWhat BiD Does Not Do
Sometimes the absence of something matters as much as its presence.
Sell or share your pipeline data
BiD does not sell, share, or use customer pipeline data for any purpose other than operating the service. Your competitive intelligence stays competitive.
Display ads or allow advertiser influence
BiD displays no ads and does not allow advertisers to influence the product, prioritization, or any aspect of the user experience.
Use your data to train AI models
BiD does not use customer data to train AI models. All AI calls go through our AI provider's API under its data processing terms, and the provider does not train on API customer data either.
Give staff standing access to your organization
Staff open a one-hour support session with a written reason before viewing or changing anything specific to your organization, and you see it in your Access Log.
Give Aspis a separate way in
Aspis' own BiD organizations are ordinary tenants, isolated from yours by the same database controls. See Avvyd, Aspis & your data.
Over-claim
We do not claim certifications BiD has not earned, and we do not call BiD zero-knowledge or end-to-end encrypted: parts of the service process data in plaintext to deliver AI analysis.
Compliance Status
Where BiD stands against common compliance frameworks, including what is not applicable and what is on the roadmap.
| Standard | Status | Details |
|---|---|---|
| SOC 2 Type 2 | ✓ Infrastructure | Built on independently certified cloud infrastructure. BiD itself has not undergone an independent SOC 2 audit; that is on the roadmap as BiD scales. |
| ISO 27001 | ✓ Infrastructure | Built on ISO 27001 certified infrastructure (our hosting and AI providers are ISO 27001:2022 certified). BiD itself has not undergone independent ISO 27001 certification. |
| ISO/IEC 42001 | ✓ Infrastructure | Our AI provider holds ISO/IEC 42001:2023 certification (AI management systems). BiD's AI layer inherits these controls through the provider's API. |
| GDPR | DPA on request | BiD data is hosted in the United States. A Data Processing Agreement (DPA) is available on request from legal@avvyd.ai. |
| PCI DSS | ✓ Processor handles | Our payment processor is PCI DSS Level 1 certified, the highest level. BiD never touches raw card numbers; all payment data is processed and stored by the payment processor. |
| HIPAA | Not applicable | BiD is not a healthcare product and is not configured for PHI. Our infrastructure provider is HIPAA eligible, but BiD has not configured HIPAA-specific controls. Do not use BiD to process PHI. |
| FedRAMP | Roadmap | Not applicable at current scale. FedRAMP authorization is a roadmap item for future DoD/CUI market expansion. BiD should not be used to process CUI at this time. |
| CMMC | Not applicable | BiD is a BD pipeline tool for GovCon, not a system that processes CUI. CMMC applies to contractors handling CUI; BiD is not a CUI system and should not be used as one. |
Infrastructure Certifications
BiD is built on independently certified cloud platforms, each audited against the standards below.
- AES-256 encryption at rest
- TLS encryption in transit
- Annual third-party security audits
- Hosted in the United States
- ISO 27001:2022 certified
- EU–U.S. Data Privacy Framework certified
- Automatic DDoS mitigation on all deployments
- HTTPS enforced on every deployment by default
- ISO/IEC 42001:2023 certified (AI management systems)
- Does not train on API customer data
- All BiD AI calls made server-side; API key never exposed to the browser
- Data processed under the provider's API data processing terms
- PCI DSS Level 1, the highest level of payment security certification
- BiD never stores, processes, or transmits raw card numbers
- All payment data is handled and tokenized by the payment processor
- Processor-level fraud detection and dispute management built in
How BiD Compares on Security
For context, here is how BiD's security posture compares to other GovCon BD platforms at similar or adjacent price points.
| Category | ⚡ BiD | GovDash | GovSignals |
|---|---|---|---|
| Infrastructure certs | SOC 2 + ISO 27001 (vendors) | SOC 2 + FedRAMP Mod. Equiv.* | SOC 2 + FedRAMP High |
| Data isolation | Row-level security, tested; private storage | Single-tenant option | FedRAMP enclave |
| AI data training | Never | Not stated | Not stated |
| Published pricing | Yes, from $99/mo | Custom / enterprise | Custom / enterprise |
| Target market | SMB GovCon, civilian agencies | Mid-market + DoD | Enterprise + DoD CUI |
* GovDash's FedRAMP Moderate Equivalency is not a formal FedRAMP authorization and does not appear on the FedRAMP Marketplace. DoD has explicitly distinguished between formal FedRAMP authorization and equivalency claims. GovSignals holds the only formal FedRAMP High authorization in this space.
Our Security Roadmap
We are a new company. Here is where we are headed next. Roadmap items have no committed dates.
BiD's Security Commitment
BiD is built by people who have worked inside the government contracting ecosystem and understand what this market expects. We earn trust with accurate claims and documented controls, and we update this page as controls go live.
- Database-level audit logging in production In progress
- Email notice of support sessions, and customer approval before a session opens In progress
- Written information firewall policy between Aspis and BiD customer data In progress
- Field-level encryption under a separate key for each organization
- Customer-held keys (bring your own key) for enterprise customers
- End-to-end encrypted private vault for a defined set of sensitive fields
- Formal vulnerability disclosure program
- Independent penetration test
- Independent SOC 2 audit, as BiD reaches growth scale
- FedRAMP authorization, for a future DoD/CUI market
If you have specific security requirements, want our written Security Posture and Data Custody note, or need a Data Processing Agreement, contact us directly.
We'll Give You a Straight Answer
Security questions are good questions. If you have specific requirements, need documentation, or want to discuss our controls before signing up, reach out. We respond to every security inquiry.
Security: security@avvyd.ai · DPAs and legal: legal@avvyd.ai · No sales pitch. Just answers.