Vendor data deserves the same rigor you demand from vendors

Encryption in transit

All traffic between your browser, VendMetric, and our database runs over encrypted HTTPS connections.

Role-based access control

Eight distinct roles (Admin, Procurement, Compliance, Executive, Legal, Finance, Project Manager, and Vendor) each see only what their function requires. Access is enforced on the server at every entry point, not hidden in the interface.

Tenant isolation

Every database query is scoped to your organization. No customer can see another customer's vendors, documents, or scores.

Immutable audit trail

Every vendor action, document decision, and compliance exception is permanently logged: who, what, and when. Immutability is enforced by the database itself: edits are rejected outright, and deletion requires a deliberate, separate data-erasure step. Not even the application can quietly rewrite history.

Tested tenant isolation

An automated suite runs on every code change, acting as a fully authorized user of one organization and attempting to reach another's vendors, documents, and records. Every attempt must be blocked before the change can ship.

Documented compliance exceptions

Manual overrides always require a written justification and are fully attributed and auditable, never a silent bypass.

Secure, hashed credentials

Passwords are never stored in plain text. Session tokens are signed and scoped to your account.

Multi-factor authentication

Any team member can turn on TOTP-based two-factor authentication, and an admin can require it organization-wide with one toggle. The stored secrets are encrypted at the field level, never in plain text.