Security and your data

This page explains, in plain terms, where your SupplierVault data lives, who can see it, how it's protected, how you get it out and how it's deleted. If your IT or security team needs more detail for a due-diligence questionnaire, email hello@suppliervault.co.uk.

Where your data is kept

Our hosting providers encrypt data at rest and in transit (connections use HTTPS).

Who can see your data

• Only members of your organisation. Every table in the database has row-level security, so a signed-in person can read only the organisations they belong to. Signed-out visitors get nothing.
• Roles. Each member is an Admin, Editor, View only or Auditor, or has a custom role that limits what they can change. View-only people can look but not change anything. Only admins can change settings, invite people, download all data, create API keys or close the organisation. See Account, team and security.
• Access by area (Professional plan and above). An admin can give each person only certain areas, such as Facilities or Marketing. Everything linked to a supplier (its tasks, invoices, files, history, portal links and signatures) follows that supplier's area, and the calendar feed and the AI assistant respect it too. Admins always see everything. With teams set up, a team's areas and the suppliers it manages decide what its people see, checked by the database in the same way.
• Live updates travel on a private channel for your organisation. Only a record's reference is broadcast; each browser then re-reads the record under the same security rules.
• Groups of companies. If your organisation joins a group, people in the group organisation can see a read-only summary of your suppliers (names, company numbers, stage, tier, area, contract value and dates, certificate expiry). Never documents, bank or payment details, forms, sign-offs or history. Every time they open it, it's recorded in your access log, and either side can end the link. See Groups of companies.
• Suppliers never get into your workspace. Each supplier contact gets their own secure portal link, which shows only the forms you chose to send, lasts between 1 and 90 days, and can be turned off at any time. A supplier with a free supplier account sees only the requests sent to their own confirmed email address, and each customer only ever sees what the supplier sends to them. See Supplier portal.

Signing in securely

• People sign in with Microsoft (Microsoft 365 / Entra ID), Google, or their work email and a password of at least 8 characters, confirmed by email. With Microsoft or Google, SupplierVault never sees their password: it only receives their name and verified email address.
• An admin can switch on company sign-in only, so nobody in the organisation can use a SupplierVault password. Like two-step sign-in, this is enforced in the database itself.
• Anyone can add two-step sign-in: a 6-digit code from an authenticator app such as Microsoft Authenticator or Google Authenticator.
• An admin can require two-step sign-in for everyone. This is enforced in the database itself: a session without the second step can't read or change anything in that organisation.
• Password reset links and confirmation links work once and expire (one hour for resets). Asking for a reset never reveals whether an email has an account.
• An admin can also lock company sign-in to your own Microsoft tenant or Google Workspace domain, so staff of other companies can't get in even with an invitation.
• SAML single sign-on (for identity providers other than Microsoft and Google, such as Okta) isn't available yet. Tell us if you need it.
• On the Enterprise plan, Microsoft Entra ID or Okta can add and remove people automatically. SupplierVault receives each person's name, email address, role and whether they're active, and keeps only a hashed copy of the token. See Add and remove people automatically.

Bank details and payments

• SupplierVault never stores full bank account numbers or IBANs, only the last four digits. The supplier set-up form says: "Full account numbers and IBANs are never stored in the hub. Send them on company letterhead to Accounts Payable."
• SupplierVault never moves money, makes payments, sends test payments, connects to bank accounts or reads bank data. It records the checks your team carries out.
• A change of bank details holds the supplier's invoices until a call-back, Confirmation of Payee check and penny test are recorded, and a second person releases it. This is enforced in the database. See Bank details and fraud checks.
• The supplier portal can't change bank verification, and the AI assistant never sees bank details.
• If you connect your accounting software (Xero, QuickBooks Online, Sage Accounting, Sage 200 or Microsoft Dynamics 365 Business Central), SupplierVault only reads supplier bills, credit notes, payments and contacts, never bank details. It never writes to them or moves money. QuickBooks and Business Central have no read-only permission, so they ask for access to your accounts, but SupplierVault only ever reads. Each connection's access keys are stored on our servers, never shown in the app, and removed when you disconnect.

The audit trail

SupplierVault keeps two layers of history:

1. The activity trail on the Audit trail page: who did what and when, in plain words. It is add-only. The database refuses any edit ("The audit trail cannot be edited") or deletion ("The audit trail cannot be deleted"), and each entry must be recorded as the person who made it. The only exceptions are example data and closing the whole organisation.
2. Change history: the database automatically records every insert, update and delete of every record, with the before and after values, who made the change and when. It's included in "Download all data".

Tamper-evident: every entry in the change history, including every audit trail event, carries a SHA-256 fingerprint of its contents and of the entry before it, like a ledger. Changing or removing any past entry would break the chain. The history can't be edited or deleted through the app by anyone, and is only removed when an organisation is closed. Run the check yourself from the Audit trail page (Check the audit trail now). Every evidence pack ends with the result and the latest fingerprint.

Access log: SupplierVault records when auditors sign in and when anyone opens a document, downloads an audit or evidence pack, or uses "Download all data". Admins and auditors can download it. See Audit evidence for auditors.

Electronic signatures are also add-only, with the signer's name, the time, their IP address and a SHA-256 fingerprint of the exact document signed. See Audit trail and packs.

Secrets stored as fingerprints only

API keys, calendar links and supplier portal links are never stored as written. SupplierVault keeps only a one-way fingerprint (hash), so nobody, including us, can read them back. That's why a new key or link is shown once, and why making a new calendar link stops the old one.

Size limits

Getting all your data out

An admin can download everything at any time, including after a plan has ended: account button › Organisation › Your data › Download all data. You get a zip file named "SupplierVault export - <organisation> - <date>.zip" containing:

• README.txt: what each file is
• data.json: your organisation, team and every record, grouped by type
• history.json: every change, with who, when, before and after
• signatures.json: every electronic signature with signer, time, IP address and document fingerprint
• portal-links.json: the supplier portal links sent (not the links themselves, which are never stored)
• csv/: one spreadsheet per record type, plus team.csv
• files/: every document you uploaded

Linked documents aren't included, only their links, because they live in your own systems.

Deleting data

• Delete one supplier (admin): Documents and history tab › Legal hold and deletion. It needs a reason, live suppliers must be offboarded first, closed suppliers are kept for your retention period (6 years by default), and nothing can be deleted under a legal hold. The database enforces these rules. See Retention and legal hold.
• Close an organisation (admin): account button › Organisation › Close this organisation. Type the organisation's name, click Close organisation, then confirm. This permanently deletes every supplier, record, file, signature, portal link, API key, the change history and the team. It can't be undone, so download your data first.
• Delete your own account: account button › You › Delete my account, type DELETE and confirm. Organisations where you're the only member are closed and deleted. Records you created stay with your organisation. If you're the only admin of an organisation with other members, make someone else an admin first.
• After closing, data is deleted within 30 days and backups are overwritten within a further 7 days.

Who processes your data

For the supplier and contact information you enter, your organisation is the controller and SupplierVault is the processor, acting on your instructions. SupplierVault is run by Gary Callaway as a sole trader and is registered with the Information Commissioner's Office (ICO), registration number ZC262506.

Xero, QuickBooks (Intuit), Sage Accounting and Sage 200 (Sage) and Business Central (Microsoft) aren't on this list: if you connect one, it's your own provider, and SupplierVault reads from it on your instructions. The same goes for your identity provider if you use automatic syncing. The full details are in our privacy notice and terms.

Related

• Account, team and security
• Audit trail and packs
• AI assistant
• The API
• Add and remove people automatically