Security statement

This statement covers the Coira application at coira.ie, its application database, and the sub-processors named below. It covers customer content submitted to the service, customer account data, and the compiled archive of public procurement notices. It does not cover the security of a customer’s own devices, networks or email.

The contracting entity for Coira has not yet been established. Until it is, the operator details in the terms of service and the privacy notice are provisional and no paid subscription is accepted through the site.

The application is hosted on Vercel and the database on Supabase. Coira operates no servers or storage of its own.

The Supabase project region was read from the provider dashboard on 3 September 2026 and is eu-north-1 (Stockholm). Application data held in that database is therefore stored in the European Union as at that date.

The hosting region of the application layer has not been confirmed and recorded, and is not claimed. The remaining sub-processors are headquartered outside the European Economic Area and their serving regions have not been confirmed. Both are listed under Current limitations.

Traffic between the browser and the service is served over HTTPS. Requests that are not encrypted are not accepted.

Encryption of data at rest is provided by the hosting and database sub-processors under their own published terms. Coira has not independently verified those terms for these specific accounts, and therefore states them as the providers’ commitments rather than as its own.

Accounts authenticate by email and password, or by Google sign-in where the user chooses it. Authentication and session management are handled by the database sub-processor. Coira never receives or stores a customer password.

Multi-factor authentication is not available to customer accounts. Password policy and session lifetime follow the platform defaults of the authentication provider; Coira does not operate a separate password-complexity or forced-rotation policy.

Removing a user is not instantaneous. A session that is already signed in retains access until its token next refreshes.

Customer data is scoped to a company. Isolation between companies is enforced in the database by row-level security policies, which restrict every query to the company the authenticated user belongs to, rather than being enforced only in application code. The company is taken from the identity in the sign-in token, which the browser cannot edit.

Isolation is tested rather than asserted. The repository carries an isolation test that signs in as two real users in two different companies and compares what each is actually served — asking directly for the other company’s rows, and scanning without a filter — and reports a blocked probe as blocked rather than as a pass. The roster of company-scoped tables it probes is derived from the migrations rather than typed by hand, so a table added later is covered by the test that ships with it.

Two product rules are enforced as part of that model. A firm’s internal cost rate per hour is never selected into any client-facing output. On a team bid across firms, the only values that cross between firms are the scope label and the figure a firm has chosen to publish: no rates, no hours, no staff names and none of the build-up behind the figure. An unpublished figure cannot be read by the other firms even through the API, and publishing is reversible.

The service does not provide per-person permission roles within a company. Every user on a company account can see that company’s data.

Administrative access to the production database and hosting accounts is held by one person, the operator, and is protected by the multi-factor authentication offered by those providers.

Request logs and application error records are generated by the hosting platform and the database provider and are retained under those providers’ retention settings.

There is no security information and event management system, no automated intrusion detection, and no continuous monitoring or on-call rota. Alerting is limited to the notifications the hosting and database providers raise.

Database backups are provided by the database sub-processor under the backup schedule of the plan in use.

No recovery point objective or recovery time objective is committed to, and no documented restore test has been carried out. Until a restore has been tested and dated, Coira does not claim a restore capability beyond the provider’s own.

Where Coira acts as processor for a customer, it will notify that customer without undue delay after becoming aware of a personal data breach affecting that customer’s data, as required by Article 33(2) GDPR, and will provide the information the customer needs to make its own assessment.

Where Coira acts as controller, it will notify the Data Protection Commission without undue delay and within the period Article 33(1) GDPR allows, and will notify affected data subjects where Article 34 requires it.

There is no formally tested incident-response plan and no rehearsed exercise. The response would be carried out by one person.

The application is version-controlled, and changes are deployed from the version-controlled source to the hosting platform.

Because Coira is operated by one person, there is no independent code review before deployment and no separation of duties between the person who writes a change and the person who releases it. Automated tests run against defined rules of the application, including rules governing published claims, data provenance and cross-company isolation.

Dependencies are updated as advisories are received from the package ecosystem and the hosting providers.

No independent penetration test has been carried out, and no external vulnerability scanning service is in place.

The register below is the authoritative list, rendered from the same source as the register in the privacy notice, so the two cannot state different things to different audiences. Customers are notified by email in advance of any addition or replacement of a sub-processor.

For each provider, it has not yet been confirmed and recorded that a data processing agreement is executed for the specific account in use, or which Chapter V transfer mechanism is relied upon. Those items are shown below as unverified and will be dated when they are resolved. Hosting and serving locations are answered in section 02.

Coira has one operator and no employees or contractors with access to customer data. No background screening programme exists because there is no one to screen. If personnel are engaged in future, access will be granted only under a written confidentiality undertaking, and this section will be updated.

The service depends on a single operator. If that person is unavailable, support and incident response stop until they return. There is no second person with operational access and no continuity arrangement in place. A customer that requires continuity assurance should treat this as a live risk and take it into account in its own assessment.

The customer’s exit route in that event is the export described in section 15, which does not depend on the operator being available.

Extraction in the public tender-pack reader is deterministic. It identifies award criteria, marks, thresholds, hour schedules and deadlines from Word and PDF documents by rule, records the source document and section for each figure, and declines to return a value rather than generating one. No language model sits on the path of any figure it returns.

That statement is scoped to the reader and is not a claim about the whole product. The bid workspace offers a separate, labelled AI-assisted extraction, listed in the register above under the AI sub-processor and disclosed at the point of use. Where the two could be confused, the deterministic reading is the one that carries a document and section beside every figure.

Where a feature is AI-assisted, only the text the user enters into that feature is sent to the AI sub-processor named in the register above, for that purpose only. A customer’s rate card and fee build-up are not sent to a model. The AI-assisted features are listed in the privacy notice, and those routes are rate-limited to bound both spend and exposure.

Coira does not train any model of its own on customer content. Whether a provider may use submitted content for its own model improvement depends on that provider’s terms and the service tier in use, which has not been confirmed and recorded for every provider.

Documents submitted to the public tender-pack reader are processed in the request that submits them. They are not written to file storage, not written to the application database, and not written to logs — not the bytes, not the extracted text, not the file name and not the project name. No caller-supplied file path is ever opened; the reader is given only the bytes in the request. Uploads are capped at 4 MB in total and 30 files, checked against the declared part sizes before anything is decompressed.

Documents uploaded to a project’s document library are different, and are retained by design. The file is written to object storage and a record of it — file name, media type, size and the text extracted from it — is written to the application database, so that the project can be worked on over time.

Access to those records is decided in the database, per document and per person. A record can be read by the person who uploaded it, by the owner of the project it belongs to, and by anyone who has been added to that project as an active member. Membership is granted person by person: a colleague at the same firm has no access until they are added, and a collaborator invited from another firm does. Company membership is not itself the boundary here, and the document library predates the firm-scoped model used by Adjudicate, where every row does carry the owning firm. These records are covered by the export and erasure endpoint described below.

One record is written for each reading: a keyed hash of the connection address and the name of the endpoint, used to enforce the rate limit and removed by an automatic retention sweep. The connection address itself is not stored.

An authenticated endpoint provides each account holder with a machine-readable export of the data held about them and with erasure of that data, covering Articles 15, 17 and 20 GDPR, and operating only on the caller’s own identity resolved server-side. It is not yet surfaced in the interface. After termination, Coira will make customer data available for export on written request, then delete it from the live service; copies inside routine provider backups are removed on the ordinary backup cycle.

Coira holds no security certification. See Current limitations.

The following controls are not in place. They are stated so that they can be relied on in an assessment.

• No ISO/IEC 27001 certification. No certified information security management system exists.
• No SOC 2 report. Neither a Type I nor a Type II report has been produced.
• No Cyber Essentials or equivalent scheme certification.
• No independent penetration test and no external vulnerability scanning service.
• No multi-factor authentication for customer accounts.
• No per-person permission roles. Every user on a company account can see that company’s data, and removing a user does not end an existing session immediately.
• No security operations centre, no continuous monitoring and no on-call rota.
• No tested restore, and no committed recovery point or recovery time objective.
• No tested incident-response plan.
• No confirmed residency for the application hosting layer. The database region is confirmed and dated in section 02; the hosting region is not.
• No recorded executed data processing agreements with the sub-processors, and no recorded international transfer mechanism.
• No uptime commitment and no service-level agreement.
• One operator, no employees and no continuity cover.
• No published security contact address and no published vulnerability disclosure policy. See section 18.
• No customer references or case studies. No fees have been priced through the service.

A monitored security contact address on the coira.ie domain has not yet been published, and neither has a vulnerability disclosure policy. Both will be published in this section when the address exists. Until then there is no published reporting channel, and that is recorded under Current limitations rather than left for a researcher to discover.

Good-faith research will not be treated as a breach of the terms of service and Coira will not pursue legal action in respect of it, provided the testing does not access, modify or exfiltrate data belonging to another customer, does not degrade the service, and stops at the point a vulnerability is demonstrated. No bounty is offered.

A report that reaches Coira will be acknowledged, confirmed as reproduced or not reproduced, given an indicative remediation timeline, and confirmed when it is fixed.

Answers to procurement and information-security questionnaires reference this statement. Any answer not covered here will be added to it in the next version rather than given only in correspondence.