Security at Offra
Last updated: September 2026
Your bids hold pricing, references and strategy you would never want a competitor to see. This page sets out, plainly, how Offra keeps that data safe, which providers touch it, and how to reach us about a security concern. Offra is operated by Consuly Pte. Ltd., a company registered in Singapore; your data is stored and processed in the United States.
Where your data lives
Your account, tender documents, bids and workspace data are stored in the United States, in a U.S.-region database and file store. The application servers that process your requests run in the United States (California), as does this website. Every provider involved is named, with what it does, in our privacy policy.
Encryption
All traffic to Offra and to this website travels over HTTPS (TLS). Your data and uploaded files are encrypted at rest by our database and storage provider.
Your workspace is yours
Every tender, document, bid and task belongs to one workspace. The database itself enforces that boundary with row-level security, so a record is readable only by members of the workspace it belongs to — not by other customers, whatever the application asks for. Within a workspace, owners and admins decide who is invited and what role they hold.
Signing in
Every user can protect their account with two-factor authentication through an authenticator app, or sign in with Google. Passwords must meet a minimum length and are never stored in readable form.
AI and your documents
Your documents are never used to train AI models — ours or our providers'. Our primary AI route is restricted, on every single request, to model providers that keep no copy of what they are sent and do not train on it. That restriction is written into the code, not left to a setting someone could switch off. The providers we use for text recognition and as a fallback are named in our privacy policy, and their terms likewise forbid training on your content. Customer documents are never used to build Offra's benchmarks or to serve another customer. The public tender and award records Offra shows come from government registries, not from customer workspaces.
Payments
Payments are handled by Stripe. Offra never receives or stores your full card number.
Your data, on request
Ask and we will send you a full export of your account's data, or delete your account. Deletion removes your stored files and, when you are the last member, the whole workspace. Write to privacy@offra.cc.
Report a security issue
If you believe you have found a vulnerability in Offra, write to security@offra.cc. Please give us a reasonable chance to fix it before disclosing it publicly. We will acknowledge your report and keep you informed as we work on it. Our security.txt file is at /.well-known/security.txt.