Encrypted the moment it is saved
An account number is never plain text in the database — AES-256-GCM at rest, from the moment it is stored.
Security & GDPR
There is no “Security” screen. There is how the whole thing is built.
Data protection in VendoCerta is spread across the product: in how the trail is recorded, in who may see which document, in how a bank account is encrypted, and in what a role deliberately cannot do. This page gathers it in one place — including the parts where the honest answer is “not yet”.
The record
An entry cannot be changed or deleted. Not even by the owner.
Every recorded action becomes an entry: a sign-in, a supplier status change, a document decision, an invitation sent, a file downloaded. VendoCerta has no function anywhere to edit or delete one, and never overwrites an existing event.
- Before and after, on every data changeEach entry carries who, what, when — and for a change, what the values looked like on both sides of it.
- Refusals are recorded tooIf somebody tries to open something they have no permission for, that attempt is an entry. Repeated attempts are therefore visible rather than silent.
- A filtered view is a linkFilters go into the page address, so a specific slice of the trail can be handed to a colleague — or an auditor — as a URL. That is exactly how a single case links to its own history.
- Its own retention, and we say soThe number of days at the foot of the audit screen is not the field on the settings screen. Audit retention is a separate setting that cannot currently be changed from the interface, and changing the other one will not move it.
app.vendocerta.com/audit
Payment fraud
The one operation the product refuses to make convenient.
Changing a supplier’s bank account is four stages and a rule about who may finish them. Everything else in VendoCerta is designed to remove friction; this is designed to keep it.
- 01
Proposal
Deliberately not a Reviewer. The Propose a change button stays disabled until this supplier has an uploaded document in the “Payment details” category — an account cannot be proposed out of nowhere. The number is typed twice, as a check against a mistyped digit.
Awaiting document confirmation
- 02
Document confirmation
A Reviewer, Administrator or Owner opens the record and clicks Confirm it matches the document. Judging whether the bank confirmation is genuine is this step’s whole job — the system only requires that the document exists and has a current version.
Awaiting independent verification
- 03
Independent verification
Recorded with a stated method: a call back to a contact known beforehand — phone only, never e-mail, because the e-mail account may be exactly what an attacker holds — a confirming letter from the bank, a signed power of attorney, an in-person meeting, or “other”.
Awaiting approval
- 04
Approval
Nobody who has already appeared in this case may cast the final approval: not the proposer, not the confirmer, not the verifier, not an earlier approver. If the same account number already sits against another supplier, a duplicate warning must be knowingly dismissed before approval is possible at all.
Active account
What the four stages actually guarantee
It is worth stating this precisely, because it is gentler than four stages suggests and the precision is the point. The same person may confirm the document, carry out the verification, and even cast the first approval. There is one hard condition, and it is absolute: nobody who has already appeared in the case may give the final approval.
In practice that guarantees a minimum of two different people when one approval is required, and three when two are — which is the default. Sometimes it takes a genuinely fourth, previously uninvolved person.
Revealing it costs three things
The sensitive-data permission, your password again even though you are signed in, and a stated reason recorded in the trail. The reason is recorded; the number never is. It clears from the screen after 45 seconds.
Duplicates are surfaced, not hidden
If the same account number already sits against another supplier, the warning has to be knowingly dismissed before approval becomes possible at all.
Separation of duties
Five roles, and the surprising one is deliberate.
The system administrator keeps the installation running — configuration, diagnostics, backups — and has no visibility into suppliers, documents, cases or bank accounts at all. The exact opposite of the business administrator, who runs the supplier side and cannot restore a backup.
| Capability | Owner | Business administrator | System administrator | Reviewer | Observer |
|---|---|---|---|---|---|
| Sees suppliers and documents | Yes | Yes | — | Yes | Yes |
| Adds and edits suppliers | Yes | Yes | — | — | — |
| Reviews documents and decides on approval | Yes | Yes | — | Yes | — |
| Sees sensitive documents (payment details) | Yes | Yes | — | — | — |
| Manages users and roles | Yes | Yes | Yes | — | — |
| Restores a backup | Yes | — | Yes | — | — |
The rules a role cannot talk its way around
- Nobody — including the owner — can change their own role.
- An administrator cannot create, or demote, an account holding the owner role.
- The last remaining owner account cannot be demoted or disabled, so a company is never left with nobody in charge of it.
- Two-factor authentication is mandatory and unskippable for owner, business administrator, system administrator and reviewer. An observer may switch it on but does not have to.
- A failed sign-in never says whether it was the e-mail or the password, so the screen cannot be used to discover whether an account exists.
app.vendocerta.com/users
Data protection
What is held, who can reach it, and for how long.
Sensitive documents need their own permission
Ordinary supplier documents are visible to anyone with access to the record. Documents marked sensitive — chiefly payment-related — need a separate permission on top, which in practice means owner and administrator only. Trying to open one without it produces a refusal, and the refusal is recorded.
Files are never a permanent URL
A download goes through a digitally signed link valid for a few minutes and tied to your own company. Opening it from another context gets nowhere. Every download of a sensitive file is audited separately.
Retention: seven years by default
The documents-and-retention setting defaults to 2,555 days, matching typical procurement audit requirements, and can be changed at any time. Honestly: today it records your policy and will drive future housekeeping — nothing is deleted automatically because the date passed.
Invitations expire, and reissuing revokes
An invitation link is a single-use random token with a limited life, a week by default. Sending a new invitation invalidates the previous one immediately, even if somebody had opened it — and that is currently the only way to cut a link off; there is no separate revoke button.
Bank details encrypted at rest
AES-256-GCM from the moment of saving. The stated reason for revealing a number goes into the audit trail; the number itself never does.
A support report that carries no data
The diagnostics tab of the system centre produces a report for technical support containing versions, counts and masked log lines — never document contents, banking details or suppliers’ personal data.
app.vendocerta.com/settings/security
For your security team
The questions an assessor sends first.
Is VendoCerta a cloud service we are trusting with our data?
No. It installs onto a machine you control. PostgreSQL, object storage and the mail preview run as portable binaries inside the project folder — nothing installed into Windows, no administrator rights, Docker optional. Internet access is needed on first run to fetch those services, and after that the installation is yours.
Can we get technical documentation beyond this page?
Yes. The installation ships with the security model and threat model as documents in the repository — the same sources this page is drawn from. Ask whoever maintains your installation, or ask us on the demo form and say it is for a security review.
What does the AI assistant have access to?
Only what the person asking may already see, and it never carries out an action without that person’s explicit confirmation — permissions are re-checked at the moment of the click, against the person clicking. It cannot approve, reject or suspend a supplier, cannot change a role, and cannot delete anything.
Does a password reset get somebody past two-factor authentication?
No. For the roles where the second factor is mandatory it is mandatory on every route into the account, including after a reset.
Where are e-mails sent during a pilot?
Into a local preview inbox on the installation itself, not to real recipients — so a pilot cannot accidentally e-mail a supplier. The system centre’s installation tab says which mailbox an installation is actually using.
Send us your security questionnaire.
We would rather answer it before the demo than during it.