Tender Response: Hosting & Security

1. Executive summary

The Love to Ride Student Challenges platform is built and hosted on the Base44 platform, a managed backend-as-a-service that provides hosting, database, authentication, integrations, and a continuous security scanning pipeline.

• Hosting: Managed private infrastructure, continuously monitored, with data encrypted at rest and in transit.
• Data residency: EU. Application data is stored in the European Union.
• Compliance: Base44 is SOC 2 Type II compliant and ISO 27001 certified. A Data Processing Agreement is available.
• Backups: Automatic, covering table records. 7-day retention (Elite plan). Uploaded files and images are not included in backups and are managed separately.
• Application security: Row-Level Security on every data table; encrypted secrets vault; platform-managed authentication; recurring automated security and dependency scans.

2. Hosting infrastructure

2.1 Platform model

The application runs on Base44's managed private infrastructure. Base44 provisions and operates the hosting, runtime, database, file storage, and integration layers; the application owner is responsible only for app-level configuration (data model, permissions, and security settings).

2.2 Encryption

• At rest: Application data is encrypted at rest.
• In transit: All traffic is encrypted in transit (TLS).
• End-to-end encryption: Not applicable. Data is not end-to-end encrypted; Base44 administrators may access data where operationally required.

2.3 Monitoring

The hosting environment is continuously monitored by Base44 as part of the managed service.

2.4 Availability

Base44 does not publish a specific uptime percentage or SLA in its public documentation. Availability information, if required, can be requested through the Base44 Trust Center.

3. Data residency & backups

3.1 Data residency

• Storage region selected for this workspace: European Union (EU).
• Residency controls where data is stored, not where it is processed.
• Account and billing information is retained in the US regardless of residency selection.

3.2 Backups & restore

• Backups are automatic and cover table records.
• Retention: 7 days (Elite plan, as configured for this workspace).
• Uploaded files and images are not included in backups.
• Full backup and retention schedules are available in the Base44 Trust Center.

4. Compliance & certifications

5. Application-level security

5.1 Authentication

• Platform-managed authentication (email/password plus optional SSO providers).
• Sign-in can be required for any page; app visibility can be set to Private, Workspace, or Public.
• Session tokens are stored in browser localStorage. HttpOnly cookie storage is not currently offered by the platform.

5.2 Data access control (Row-Level Security)

Every data table enforces Row-Level Security (RLS), governing which authenticated users may create, read, update, or delete each record. Rules are defined per table and evaluated server-side; no rule defaults to open access. Individual fields can additionally be restricted with Field-Level Security (FLS).

For this application, RLS is configured so that:

• Public-facing content (challenges, leaderboards, home-page stats) is readable by anyone.
• Administrative and customer-reporting data is restricted to authorised roles (admin, challenge_admin, customer_admin, customer_reporter).
• Submissions and school/class records are writeable by their creators and by authorised staff roles.

5.3 Secrets management

Third-party credentials (e.g. the Resend API key used for outbound email, Slack bot tokens for notifications) are stored in Base44's encrypted secrets vault. Secrets are accessible only from the application's backend functions and are never bundled into the client application or exposed to end users.

5.4 Integrations & third-party connections

External service connections are established through OAuth connectors rather than hardcoded credentials:

• Slack Bot — authorised with scoped tokens (chat:write, channels:read).
• HubSpot — workspace-registered OAuth connector.

5.5 Security scanning

The application is enrolled in Base44's recurring Security Center scans (workspace level), which review:

• Code vulnerabilities and exposed secrets.
• Row-Level Security gaps (open reads / open writes).
• Dependency vulnerabilities (via Wiz integration).
• Optional third-party penetration testing (Tenzai).

Scan results and remediation history are available in Dashboard → Security and Workspace settings → Security Center.

6. Roles & access governance

User invitations are issued through the platform's invite workflow; role assignment is admin-controlled.

7. Known limitations & disclosures

1. No published SLA / uptime percentage in public documentation — available on request via the Trust Center.
2. No HttpOnly cookie session storage — tokens are held in browser localStorage.
3. Backups exclude uploaded files/images — these are stored separately and not covered by the 7-day table-backup retention.
4. Not end-to-end encrypted — Base44 administrators may access data where operationally required (consistent with a managed-service model).
5. Custom email domain — outbound email to non-app-user recipients relies on a verified custom domain and a third-party provider (Resend); delivery to non-registered addresses is subject to the provider's recipient-hygiene and anti-abuse controls.

8. Summary attestation

The Love to Ride Student Challenges platform is delivered on a managed, continuously monitored infrastructure that is SOC 2 Type II compliant and ISO 27001 certified. Data is encrypted at rest and in transit, stored in the EU, governed by server-enforced row-level security, with credentials held in an encrypted secrets vault. The application is subject to recurring automated security and dependency scanning, with automatic 7-day backup retention of table records.

References

• Base44 security overview — docs.base44.com/Setting-up-your-app/security-overview
• Privacy and security — docs.base44.com/Community-and-support/Privacy-and-security
• Backup & restore — docs.base44.com/Enterprise/backup-and-restore
• Running a security scan — docs.base44.com/Setting-up-your-app/running-a-security-scan
• Base44 Trust Center — trust.base44.com
• Data Processing Agreement — base44.com/dpa

This document states only platform capabilities confirmed in Base44's published documentation.