Skip to content
DekkoCORE

Hand out the tender pack.Get every key back.

DekkoCORE gives critical infrastructure agencies one end-to-end encrypted place to issue tender documents, answer tenderers' questions, receive bids and share the designs that are their IP. Each tenderer sees only what's shared with them, access ends when the tender closes, and every view and download is recorded.

Book a demo Follow one tender

Key cabinet · Example WaterT-2026-031

Sign out a key
04Design libraryThe Design library key stays in the cabinet: Agency only.

Signed outTap a key

No keys out. Every key is on its peg.

The tender pack

A tender pack is a map of the site.

Site plans, single-line diagrams and security arrangements tell a tenderer how to build the upgrade. In the wrong hands, they show where the site is weakest. Emailed or copied to a USB, they leave copies you can't call back.

T-2026-031 · Pump station 14 upgradeExample files
  • PS14_site_security_plan.pdfOFFICIAL: Sensitive
  • PS14_single_line_diagram_r3.pdfOFFICIAL: Sensitive
  • PS14_process_and_instrumentation_r2.pdfOFFICIAL: Sensitive
  • Specification_volume_1.pdfOFFICIAL
  • Geotechnical_report.pdfOFFICIAL

One tender

From the first key out to the last one back.

Follow the pump station 14 upgrade tender at Example Water, a fictional water authority, with three tenderers and a close of 2:00 pm, 14 Nov.

The key cabinet for the Pump station 14 upgrade tender. Each tenderer signs out a tender pack key after signing the deed, and a return folder key when bids are due. At close every key comes back. At award, Tenderer B signs out the construction set key. The design library key never leaves the cabinet.

  1. Day 1 · Procurement team

    Each tenderer signs the deed, then gets a key.

    The confidentiality deed goes to each shortlisted tenderer as a signature request. Once it's signed, the procurement team shares the tender pack with them View only, with access that ends at tender close. Drawings and the site security plan open in the secure viewer, with nothing to download.

    • Signature requests on the confidentiality deed
    • View only, in the secure viewer
    • Access that ends when the tender closes

  2. Week 2 · Procurement team

    Addenda reach every tenderer at once.

    When a drawing changes, the new revision goes into the same folder, so every tenderer with a key sees it. Questions come in by encrypted mail, and a message sent in error can be revoked if it hasn't been read.

    • One folder, the same update for everyone
    • Earlier revisions kept in each file's history
    • Encrypted mail you can revoke before it's read

  3. Week 4 · Each tenderer

    Bids go into each tenderer's own return folder.

    Each tenderer gets a second key, to a return folder of its own, and can't see any other tenderer. Bids of any size go up in the browser or through the Upload Accelerator, and every upload is recorded in the audit log with its date and time.

    • A return folder for each tenderer
    • Tenderers can't see each other
    • No file size limits

  4. Tender close · Procurement team

    At close, every key comes back.

    Shares on the tender pack and the return folders reach the expiry you set, and access ends on its own. The evaluation panel reviews the bids, and the audit log shows which documents each tenderer opened.

    • Access ends at the expiry you set
    • Revoke any share at any time
    • Audit log of every view and download, exportable as CSV

  5. Award · Successful tenderer

    The contract goes to one tenderer. The designs stay with you.

    The successful tenderer gets a new key, with Download access to the construction set it needs to build. The other tenderers' access has already ended, and the agency's designs, standards and evaluation stay in its own Hubs.

    • Download access to the construction set only
    • Your design library never leaves your Hubs
    • A data expiration policy for what you no longer need

Protections

What your security team will ask.

Hosted in Australia, IRAP assessed
DekkoCORE is hosted in-country and IRAP assessed for Australian government PROTECTED information.
Zero-knowledge, end to end
Every file is encrypted on the device that uploads it. DekkoSecure can't open your drawings, and neither can anyone outside the share.
Classification markings, required
Mark files OFFICIAL: Sensitive or PROTECTED, and require a marking on every upload and message.
Hubs open only from where you allow
Region protection is an IP-based allow-list for every Hub: a first line of defence, alongside sign-in.
Sign-in you can enforce
Enforce two-factor authentication or passkeys with hardware attestation for everyone in the tenancy.
Every bid scanned
Cloud-based malware scanning over ICAP checks files from tenderers as they arrive, before your evaluation panel opens them.

In the product

Marked, described, and answered in confidence.

A DekkoCORE Hub's file list under an export controlled banner, with a classification, an owner and a version for each file
Every file marked and describedClassification, version and owner sit beside every file in the Hub, under a banner your tenancy sets.
An encrypted DekkoCORE mail message marked PROTECTED, with reply and forward controls and a Revoke button
Questions answered, and revocableEncrypted mail between your team and each tenderer, marked with its classification, with a Revoke button on every message.

Questions

Asked by procurement and security teams.

Can tenderers see who else is tendering?

No. Tenderers are invited to the Hub as External Members, who only see your Team Members. They can't see or contact other External Members, even when the same tender pack is shared with them.

Can tenderers download the drawings?

Only if you let them. Share PDF drawings View only and tenderers read them in the secure viewer without a copy leaving the platform. Native CAD files can't be viewed in the browser, so give Download access to those only where it's needed.

What happens when the tender closes?

Every share you set to expire at close ends on its own, and you can revoke any share at any time. The files stay in your Hub, and your own access doesn't change.

Do tenderers need a DekkoSecure subscription?

No. Tenderers are invited by your agency and register a DekkoSecure account to take part. Their own organisation doesn't need a subscription.

How do we know when each bid arrived?

Every upload is recorded in the audit log with the person, the date and the time. Export the log as CSV for your probity records, or stream it to your Log Analytics workspace.

Where is the data stored?

In Australia, for Australian agencies. DekkoCORE is hosted in-country and IRAP assessed for Australian government PROTECTED information.

Every key back on its peg

Bring us your next tender pack.

Show us how tender documents reach tenderers today. We'll set up a tender Hub to match, with the deed, return folders and closing date ready to go.

Book a demo