VendorX is designed with multi-tenant data isolation, defense-in-depth security, and transparent compliance milestones. We earn trust through engineering, not marketing.
VendorX protects your data with four-layer tenant isolation including database-enforced PostgreSQL Row-Level Security (logically separated by customer account at every layer from the EF Core query filter down to the database policy), OAuth 2.0/OIDC authentication, five-tier tenant role-based access control, and encryption at rest and in transit. SOC 2 Type I attestation is on our roadmap (target Month 5-6 post-launch per Tier-3D §3.18 Security Policy). We earn trust through engineering, not marketing.
How VendorX protects your data at every layer.
Four-layer defense: Entity Framework query filter at the application layer, per-request tenant-scoped PostgreSQL session variable, database-command verification interceptor that fails closed if tenant context is not set, and PostgreSQL Row-Level Security policies on every tenant-scoped table. Tenant data is logically separated by customer account at the database itself, not just the application. Detail at /trust-center/tenant-isolation.
OAuth 2.0/OIDC via OpenIddict with five-tier tenant role-based access control. MFA-gated control plane with session rotation and fail-closed session validation.
TLS 1.3 enforced on all connections. AES-256 encryption at rest via Azure Database Transparent Data Encryption with Microsoft-managed keys today; customer-managed keys (BYOK) held by the platform operator in Azure Key Vault on our near-term roadmap (FEAT-163). HTTPS required for all API communication.
Five-tier tenant RBAC (Customer, Fulfillment Coordinator, Sales Rep, Sales Manager, Administrator) with permission-based action-level gates. A separate platform-administrator role exists VendorX-side for cross-tenant operations under audit and least-privilege discipline (see /trust-center/roles). Step-up re-authentication for sensitive operations.
Structured audit logging on all endpoints via Serilog. Tamper-evident integrity verification on privileged control-plane operations. Role-gated audit exports.
Every pricing decision (guardrail checks, approvals, overrides, realized-price calculations) is sealed into a SHA-256 hash chain. Each record links to the prior record, so any alteration to historical pricing data breaks the chain and is detected automatically on verification. On-demand and scheduled chain integrity jobs.
Per-tenant API rate limiting with FluentValidation on all endpoints. Defense-in-depth request pipeline with parameterized queries and structured error responses.
Automated dependency scanning via GitHub Dependabot. OSS license audit and Software Bill of Materials (SBOM) baseline completed. Emergency patch SLAs enforced.
GitHub Actions CI/CD pipeline with automated testing, lint checks, and security scanning on every pull request.
Honest milestones, not marketing badges. Here is where we stand today.
TOTP verification, backup codes, trusted device management, rate-limited challenges with automatic lockout.
Production RBAC with configurable tenant security policies (NIST AAL2 baseline). Step-up MFA for sensitive operations.
Append-only audit trail on all endpoints. Tier-redacted detail views, CSV/JSONL export, and audit-of-audit event logging.
Every pricing decision sealed into a SHA-256 hash chain. Each record links cryptographically to the prior record — any edit to historical data breaks the chain and is detected automatically. On-demand and scheduled chain verification jobs.
Sentry error tracking, OpenTelemetry distributed tracing, Prometheus metrics. Structured logging with Serilog.
Policy documentation in progress. Gap assessment and Sprinto readiness kickoff planned.
Dependent on SOC 2 Type I completion and 6-month observation period.
Integration partner selected (WorkOS). Implementation pending FEAT-122.
First engagement being scheduled. Focus: cross-tenant access, authentication bypass, API security.
Continuous security testing program. Activation dependent on platform maturity.
Documentation and evidence supporting our security posture.
How VendorX ships, measures, and recovers. The DORA Four Keys (deployment frequency, lead time, change failure rate, time to restore) plus the 2023 reliability addition, instrumented end-to-end via GitHub Actions, Sentry, OpenTelemetry, Prometheus, and an incident register that turns every recovery into a documented landmine. Honest about scale: we report posture, not a DORA performance band, because tier classification at solo-engineer Year-1 volume is statistically meaningless. Methodology, toolchain, and roadmap at /trust-center/engineering-velocity.
Published vulnerability disclosure policy based on CISA VDP template. Includes scope definition, safe harbor commitment for good-faith security researchers, severity-based response SLAs, and coordinated disclosure timeline. Accessible at /trust-center/vulnerability-disclosure.
Documented data retention and disposal policy covering tenant data, audit logs, backups, and account closure procedures. Retention periods aligned with legal requirements and operational needs. Partners receive data export and deletion confirmation upon request.
Request a security review or speak with our security team directly.