Confidential work needs clear boundaries.

Separate public research from private work

A public guide does not make your notes, files or bid drafts public. Private functions check sign-in and membership of the relevant workspace. A business name published in a notice is different from a private client profile.

Give each person their own access and assign suitable tasks and roles. Shared passwords make it harder to attribute changes or withdraw a particular person’s access.

A verified domain is an access criterion

Premium includes unlimited members of the same verified business domain in one workspace. Personal/free email and off-domain addresses require individual manual approval. That check does not replace your internal decision about which documents each member should see.

Review memberships, roles and outstanding invitations regularly. When someone leaves your business, manage their platform access as deliberately as their email and other business systems.

Make a permission decision before uploading

Avoid unnecessary personal data, other organisations’ confidential information and documents whose terms prohibit the proposed processing. Remove passwords, credentials and payment details that are not needed. Storing a file in the evidence library does not authorise every later use.

AI features check the relevant processing permission. Review the selected documents and purpose before starting an analysis. File and usage limits still apply when team membership is unlimited.

Three practical protection habits

Use a unique, strong password and an up-to-date browser. Sign out on shared devices. Check the website address before entering credentials and use the official sign-in route.

• Do not email passwords, session cookies or full card details.
• Protect exports and downloaded documents within your own organisation.
• Also check deadlines and important work stages within your own business process.

What to request for your procurement assessment

If your organisation needs a security or privacy assessment before use, identify the requirements: information types, processing, access roles, processor arrangements, locations, erasure criteria and recovery. This lets us distinguish available information from matters needing separate clarification.

A published feature does not establish a signed processing agreement or a particular data location. Read certificate and membership information by holder, issuer, scope and date; it is not a blanket technical audit of every platform component.

Report a concern safely

Email kontakt@vergabezone.de with the affected page, time and a factual description. If you encounter another party’s information, do not open or copy further content. Start with the minimum details needed to understand the issue, without redistributing sensitive material.

This contact route does not promise a continuously staffed security centre, a particular response time or an error-free service. A required contractual assurance needs an expressly agreed arrangement.