Legal
Security
How TenderLoop is designed to keep your portal access under your control.
What TenderLoop stores
TenderLoop stores the record that you and your agents write: one entry per tender with status, deadlines, next steps, files, money and notes with their authors. It shows only what was logged.
Your portal logins stay with you
TenderLoop does not read portals. Portal logins stay with your agents, your password manager, or your own Crawlab instance if you use optional readers. They are not sent to the TenderLoop website or its operator.
Tokens
The plugin reaches your tender record with a TenderLoop tracker token. It reaches optional readers with a separate Crawlab token, needed only if you use readers. You provide each through an environment variable. Use tokens limited to what you need, and rotate one if you suspect exposure. Do not paste tokens into chats or commit them to repositories.
Separate record and reader operations
The MCP exposes three tools and validates every call against one registry of operations. Record operations and optional reader operations are separate groups, and they use separate tokens, so you can give an agent one without the other.
This website
The site is static HTML and CSS with one small script for the copy button. It sets no cookies, loads no third-party scripts and is served with security headers (content security policy, no framing, no content sniffing).
Report a vulnerability
Write to sami@samihalawa.com with the details and steps to reproduce. Please give us reasonable time to fix the issue before public disclosure. We will acknowledge your report and keep you informed.
Last updated: 7 November 2026.