Controls we can name.
Security pages that list other companies' certifications are advertising. This page lists what HubGov actually runs.
SEAO
Québec public notices
CanadaBuys
Federal tenders
EN · FR
Bilingual workspace
Toronto
App and database
In one line
Application servers and PostgreSQL are hosted by DigitalOcean in Toronto, Ontario. Personal information in the database is therefore stored in Canada. Cloudflare sits in front for TLS, CDN and bot protection, and may process IP addresses outside Québec.
Four moves. Not another portal.
Drawn from how capture teams actually work — find, qualify, track, submit with the authority.
- 01
Find
One list of official SEAO and CanadaBuys notices. Filters that match how a supplier actually decides: province, level, type, closing window, value.
- 02
Qualify
An explainable Match score against the company you actually run — not a win-probability theatre, not a US NAICS set-aside model.
- 03
Track
The few files that deserve a bid land on a shared Kanban: owner, requirements, source URL, comments. Spreadsheets stop being the system of record.
- 04
Submit where it counts
HubGov is not a bidding portal. You still submit on SEAO, CanadaBuys or the authority's instructions. We exist for the week before that click.
What this page will stand behind.
Access
Passwords stored as one-way hashes. Session cookie HTTP-only, SameSite=Lax. Organization data is tenant-isolated. Roles: owner, admin, member.
In transit and at rest
TLS in transit. Provider-managed encryption at rest for the Toronto database. Rate limits on sensitive actions. Security headers on the site (including framing denial).
What we do not claim
No FedRAMP, CMMC, or “US-only personnel” story. Academy course generation uses Google Gemini in the United States when an administrator runs it. Details are in the privacy policy.
If a confidentiality incident presents a risk of serious injury, Québec law requires notice to the Commission d'accès à l'information and to affected persons. We take that duty as written, not as a badge.
Questions we actually get.
Where do I report a vulnerability?+
Use the contact form and mark the message as a security report. Do not attach exploit proof-of-concept to a public ticket.
Built for businesses where data matters.
Public procurement data and your private company data are logically separated at every layer.
Secure by design
Least-privilege access across every service boundary.
Role-based access
Control what each member of your team can see and do.
Tenant isolation
Your workspace data is isolated from every other tenant.
Encrypted data
Encrypted in transit and at rest, without exception.
Audit logs
Every access and change is recorded and reviewable.
Private company data
Your company profile is never exposed publicly.
Ready to find your next public contract?
Create your company profile in minutes and receive your first targeted opportunities, for free.