Sealed bids, server clocks, and audit trails: how Civentia keeps tenders fair
Fairness in competitive tendering cannot be a UI promise. Here is how Civentia enforces it in the database and the query layer.
Published August 26, 2026
A tender only works if every bidder believes the process is fair. “We promise not to peek” is not a mechanism — it is a hope. When we built the RFQ/tender subsystem, we set a rule: fairness must hold even if the UI is bypassed entirely.
Sealed means sealed — in SQL
In the default sealed mode, a bidding vendor’s queries are always scoped to their own tenant key. Rival bids are not hidden by the frontend; they are unreachable by the query. And until the deadline passes, even the buyer sees only how many bids exist and who submitted — prices are stripped by the service layer before anything renders.
After the deadline, the tender moves to evaluation and everything unseals for the buyer at once. Before it, nobody compares.
One clock, and it is ours
Bid deadlines are enforced against the server clock, never the submitter’s. A late bid is rejected by the server regardless of what the bidder’s laptop believes the time is. After the deadline, bids are immutable — no quiet edits while the buyer evaluates.
Choices that survive scrutiny
When the buyer opens rival bids during evaluation, that read is audit-logged. The award itself is logged as a critical event. If a winner backs out, the tender can re-award to the runner-up — and that transition is logged too. A dispute two months later has receipts.
Modes for different procurements
Sealed is the default, not the only mode. A tender can run open (the buyer watches live prices; bidders still cannot see each other) or as a reverse auction (bidders see the current best price — never the rival’s identity — and undercut it). The sealing policy is a single, tested function of mode, tender status, and viewer role — one place to audit, one place to get right.
Fair process is what makes buyers willing to post real demand and providers willing to sharpen their pencils. That is why it is built into the schema, and why we wrote it down here. See the marketplace channels for how tenders sit alongside inquiries and self-serve ordering.