Encrypted by default. Scoped to you.

Your workspace

A supplier's catalog, price books, connections and users are scoped to that supplier on every request. Administrative actions are logged with who did them and when.

Encryption in transit

All traffic to SupplierForge is HTTPS with strict transport security. Deliveries to buyer systems use the buyer's secure channel: SFTP, HTTPS APIs, or the buyer's own protocol.

Encryption of secrets

Buyer credentials, API keys, webhook secrets and MFA secrets are encrypted with AES-256-GCM under a master key, each value bound to the record it belongs to so it cannot be moved or swapped. Passwords are hashed, never stored.

Key management

The master key can be rotated without downtime. Rotation is interlocked so the previous key is retained until every value is re-encrypted, and a confirmation check proves the new key before it is trusted. The procedure is documented and has been rehearsed on our staging environment.

Backups and recovery

Database backups are encrypted with keys derived from the master key before they are uploaded to object storage. Before any restore, an automatic pre-restore backup is taken so a restore can itself be undone. Restores have been rehearsed, and a written disaster-recovery runbook exists.

Catalog restore

Every supplier can restore their own catalog to an earlier snapshot. A snapshot of the current state is taken automatically before the restore and kept.

Monitoring

Error tracking never receives request bodies, local variables or credentials. Failed backups, failed deliveries and failed uploads raise alerts. Scheduled jobs are heartbeat-monitored.

Edge protection

Requests are rate-limited per client, including per network for IPv6. Client addresses are taken only from trusted headers. Strict Content Security Policy and security headers are sent on every response.

Hosting

Hosted in the EU by default, with backups kept in EU object storage. Suppliers and buyers in other regions can be hosted in a region of their choice on request.

Authentication

Multi-factor authentication is available to every user and enforced for administrators. Accounts lock after repeated failed logins. Sessions expire on inactivity, with shorter windows for administrators. Cookies are HttpOnly, Secure and same-site.

Roles and scope

Access is role-based. Within a supplier, owner, approver, editor and viewer roles are cumulative, and the supplier's owner decides who can upload, approve or only view. Screen grants can only narrow what a role allows. Delegated administrators manage users only inside their own scope and never administrators. The last active administrator cannot be removed.

Buyer credentials

Credentials for your buyers' systems are entered during setup, encrypted per connection and masked in every response. They never appear in logs or error reports. To change them, ask us to replace and test the connection.

Audit trail

Logins, configuration changes, approvals and price changes are logged with the acting user, the time and the session. Client IP addresses are masked before they are stored.

Data subject rights

Users can export their personal data in a machine-readable format and request deletion. Deletion requests are approved by an administrator and anonymise the account. Consent records are kept per user.

GDPR

BoreaTech acts as processor and signs a data processing agreement with every customer. Data subject requests are handled within the statutory one month. Sub-processors are listed below; customers are notified before a change.

Sub-processors

Fly.io (application hosting), Cloudflare (edge, DNS, object storage), Upstash (Redis), Resend (transactional email), Sentry (error tracking, EU instance), Healthchecks.io (job monitoring), Hetzner (SFTP server for file delivery to buyer systems and SFTP locations hosted for customers, Finland, EU).

Data ownership and exit

Your catalog data is yours. Export it in CSV or Excel at any time. On termination your workspace is deleted and written confirmation is provided.

Certifications

SupplierForge is not yet SOC 2 or ISO 27001 certified. Certification is planned and will be funded by revenue, not promised ahead of it. The controls above exist today and can be reviewed under NDA.

Vulnerability disclosure

Report to security@supplierforge.com. We acknowledge within two business days and do not pursue good-faith researchers.