Security you can verify.
You trust us with data on your supply chain. This page shows how we protect it. We only list what is in place today.
Protection in layers
Every request passes several layers before it reaches your data.
Encrypted connection
Every connection runs over HTTPS. Browsers must connect encrypted (HSTS).
Sign-in with a second factor
Every account needs a password and a code from an authenticator app. Failed attempts lock sign-in for 15 minutes.
Separated tenants
Every query carries the identifier of your organisation. The database checks this again with row level security.
Evidence encrypted and scanned
Every file has its own key. Before the first download, ClamAV scans it for malware.
Daily backup
The database is backed up daily. An encrypted copy is kept off-site for 30 days.
In detail
Data in the EU
Your data is stored on servers in the EU. Our privacy notice names our service providers.
Passive checks only
The outside-in check reads public data only: DNS, the TLS handshake and public web pages. No port scans, no attacks.
Every change logged
Every business change is logged: who, when, what. Admins of your organisation see the log in the app.
Protection against abuse
Public forms have limits per network. We store passwords only as an Argon2 hash.
Secure files
Evidence is available only through the app, never through a public link. Every download is logged.
Strict browser rules
A content security policy and further security headers protect the app against injected code.
What we do not have yet
- We do not hold an ISO 27001 certification or a SOC 2 report at present.
- Sign-in with your company account (single sign-on) is planned.
- We claim nothing we cannot prove.
Found a vulnerability?
Please report it to security@suploris.com.
Our details are also machine-readable in the file security.txt.
Assess your first suppliers today.
Free covers up to 10 suppliers, without payment or term. Above 500 suppliers we prepare a quote.