Anyone who bids regularly has not one login but a dozen – the Deutsches Vergabeportal, eVergabe, subreport, plus the procurement marketplaces of individual federal states. Each portal needs its own password. This is exactly where the risk begins: one password for everything, or an Excel list on the team drive. Both can be avoided for each portal in two minutes.
Why procurement portals are a password problem
In Germany, public tenders are not concentrated on one central platform but spread across hundreds. One analysis counts around 800 procurement sources, of which about 200 are actively used portals. Even if the ten largest cover a good half of all notices – anyone searching across industries quickly collects accounts at eVergabe-Online, the Deutsches Vergabeportal (DTVP), evergabe.de, meinauftrag, Deutsche eVergabe and subreport ELViS.
In practice this tips into two risky patterns: a single password across all portals, or credentials kept unstructured in a spreadsheet. Both are avoidable – and in the worst case both cost you access to a running tender.
What makes a secure password for procurement portals
The BSI has recently simplified its recommendations. The often-cited requirement to change passwords every 90 days has been dropped – a change without cause only tempts people into weaker passwords. A password is changed when it has been compromised, not otherwise.
For strength, the BSI names two equivalent routes. Short and complex: at least 8 characters with four character types – upper- and lower-case letters, numbers, special characters. Or long and simpler: a passphrase of 25 characters or more, for example made of five or six random words.
For portal logins that are stored in a password manager anyway, the short, complex route is the more practical one: you don’t have to remember a random 16-character password. The long passphrase comes into its own where you type it yourself – the manager’s master password.
One portal, one password
The BSI’s most important rule: each password for a single account only. A portal login is tied to more than an email address – bid documents, calculation details, references, communication with the contracting authority. A cracked account is therefore not just an IT incident but a competitive disadvantage, in the worst case in the middle of a deadline.
Credential stuffing – the automated trying of leaked credentials on other services – only works because the same password is used more than once. A unique password per portal removes the basis for the attack.
Four steps to secure portal access
- Generate a password. For every new portal account, create a password in the password generator – 16 characters, all four character types enabled.
- Store it in the manager. Save the password together with the portal URL and username in the password manager. The BSI expressly recommends password managers – protected by a single strong master password.
- Set up team access. If several people use the same portal account, provide access through a shared manager vault – not via chat message or spreadsheet.
- Enable two-factor authentication. Where the portal offers it, also switch on two-factor authentication. The password remains the first, but not the only line of defence.
The login is solved – the real time sink remains
Secure passwords are a must, but the smallest time problem when dealing with procurement portals. The effort arises not when logging in but afterwards: with the documents. A single procedure quickly involves several dozen mandatory fields, self-declarations and attachments – which differ in form from portal to portal but always ask for the same company knowledge.
This is exactly where aiconver comes in. Instead of gathering the same references, certificates and key figures anew for every tender, industry-specific AI fills recurring fields from your existing company knowledge – with source references. For recurring fields, time savings of 80 to 90 percent are realistic. How this connects to the steps Find, Evaluate and Complete you can read in the linked articles.
Checklist: secure portal access
- Does every procurement portal have its own unique password?
- Do the passwords meet the BSI standard – 8 characters with four character types, or 25+ characters as a passphrase?
- Are all logins kept in a password manager rather than in a spreadsheet?
- For shared accounts, is access handled through secure sharing?
- Is two-factor authentication enabled wherever the portal offers it?
Frequently Asked Questions
How many characters should a password for a procurement portal have?
According to the BSI recommendation, 8 characters with all four character types are enough. In practice, 16 randomly generated characters are a good standard, because you store the password in the manager anyway and don’t type it from memory.
May I use the same password for several procurement portals?
No. The BSI is clear on this: each password for a single account only. If one portal becomes the target of a data leak, all other accounts stay safe.
Do I have to change my portal password regularly?
A change without cause at fixed intervals is no longer recommended by the BSI and tends to weaken password quality. You change a strong, unique password only if you specifically suspect it has been compromised.
Is an online password generator safe?
A generator that creates passwords locally in the browser and transmits or stores nothing is harmless. The aiconver password generator works directly in the browser, without registration. You then store the result in your password manager.
Conclusion
Secure passwords for procurement portals come down to two rules: a separate, strong password per portal according to BSI criteria, and storage in a password manager rather than a spreadsheet. A password generator takes care of the first step in seconds. The bigger lever comes afterwards – with the documents that have to be completed in every portal.
Would you like to see how these documents can be completed from your own company knowledge? In 30 minutes we go through a real example from your industry: Book an appointment.