Security
You use VendorAuditly to hold your vendors’ certificates, contracts and questionnaire answers. That makes us one of your vendors too, so this page answers the questions we would ask. It describes what is in place today and does not claim certifications we don’t hold.
Certifications
VendorAuditly is not yet ISO 27001 certified and does not have a SOC 2 report. We are an early-stage company and would rather say so than imply otherwise. The controls below are what we run today. If your review needs a completed security questionnaire, send it to support@vendorauditly.io and we will answer it.
Infrastructure and encryption
Application data and uploaded documents are stored in Supabase (managed PostgreSQL and object storage). Supabase encrypts data at rest, and all traffic between your browser, our application and Supabase uses TLS. The web application is served by Vercel over HTTPS only.
Access control
Every table that holds customer data is protected by PostgreSQL row-level security, so a signed-in user can only read and write rows that belong to their own workspace. Access is enforced in the database, not only in the application. Server functions that need wider access hold their keys server-side; they are never sent to the browser.
Vendors answer questionnaires through a unique, unguessable link and never get an account or see anything beyond the questionnaire they were sent.
AI features
When you use an AI feature, such as extracting dates from an insurance certificate, the relevant text is sent to OpenAI through its API to produce the result. Under OpenAI’s API terms, data sent through the API is not used to train their models by default. We don’t send your data to AI services unless you use a feature that needs it.
Sub-processors
| Provider | What it does for us |
|---|---|
| Supabase | Database, authentication, file storage and server functions |
| Vercel | Hosting of the web application |
| OpenAI | AI features: reading uploaded documents, drafting questionnaire answers, vendor research |
| Resend and Brevo | Transactional email (questionnaire links, reminders, alerts) |
| Dodo Payments | Payment processing; we never see or store card details |
| PostHog | Product analytics, proxied through our own domain |
Your data, on request
You can ask us to export or delete your workspace data at any time by writing to support@vendorauditly.io. Our privacy policy sets out what we collect and how long we keep it.
Reporting a vulnerability
If you think you have found a security issue, email support@vendorauditly.io with “Security” in the subject line and enough detail to reproduce it. Please don’t access other customers’ data or disrupt the service while testing. We will acknowledge your report and keep you updated while we fix it.