How VendorLens protects trust-center and supplier assessment data

Publish only what is true

Security pages lose their value when they contain broad labels that cannot be evidenced. We describe the controls and providers we actually use, avoid terms such as "military-grade" or "completely secure", and update this page when our architecture or practices materially change.

Restrict access by default

Administrative access to VendorLens and its production services is restricted to authorised team members who need it to operate or support the service. Customers control who can administer their workspace and which documents are public, restricted or private.

Separate public information from sensitive evidence

VendorLens is designed around the fact that not every security document should be public. Customers decide the access level for each document rather than publishing the entire evidence library under one shared link.

Use managed infrastructure deliberately

VendorLens uses established service providers for web delivery, application data, file storage, authentication, payments and email delivery. We remain responsible for how those services are configured and used; a provider's security programme does not remove that responsibility.

Per-document visibility

Customers choose the visibility of each uploaded document:

• Public: available from the published trust portal without an access request.
• Restricted: listed on the portal but released only through the configured request and approval workflow.
• Private: available only within the customer's administrative workspace.

Customer decisions on suitability

Customers are responsible for deciding which documents are suitable for each level. VendorLens does not determine whether a document is legally or contractually suitable for publication.

Access requests and approvals

For restricted documents, a requester provides identifying information and completes the configured acceptance or signing step. The customer then approves or declines the request. VendorLens does not automatically treat every requester as authorised.

Time-limited links

Approved access is delivered using a time-limited link. Customers can revoke an active approval, invalidating links that have not already expired. Expiry or revocation cannot retract a file that a recipient has already downloaded.

PDF watermarking

Where PDF watermarking is enabled, VendorLens creates a recipient-marked copy for download while leaving the customer's original file unchanged. A watermark helps discourage and trace onward distribution; it does not technically prevent screenshots, copying or deliberate disclosure.

Activity history

VendorLens records security-relevant document activity such as requests, approvals and downloads. This gives the customer an operational record of how restricted material was released. It is not a substitute for the customer's own legal, compliance or records-management obligations.

Invitation links are the supplier credential

Suppliers respond without creating a VendorLens account, so the invitation link itself is the credential. Links are single-purpose, tied to one assessment, expire, and can be revoked by the requesting company. Reminders issue a fresh link and invalidate the previous one.

• Only a hash of the invitation token is stored, so the original link cannot be reconstructed from the database.
• The token travels in the URL fragment, is read once into tab-session storage and is removed from the visible address bar.
• Assessment response pages are excluded from analytics, live chat and the cookie banner, and are served with no-index, no-referrer and no-store directives.
• Local response drafts in the supplier browser are keyed by a one-way digest rather than the token itself.

Questionnaire responses

Answers, clarification requests, review notes and decisions are stored against the requesting company and are readable only by that company’s authorised workspace users. Row-level database policies enforce that separation; suppliers can see only the assessment they were invited to.

Answers are validated server-side against each question’s type and frozen options, and state changes such as submission, clarification and the final decision are recorded as events that cannot be edited afterwards, with the acting user stamped by the database.

Evidence files uploaded by suppliers

Suppliers can attach evidence only to questions that request it. Files are stored in private storage and are never publicly addressable; reviewers open them through short-lived signed links, and views are recorded.

• Allowed file types: PDF, PNG, JPG, TXT, CSV, LOG, DOC, DOCX, XLS, XLSX and PPTX.
• Limits: 25 MB per file, and 30 files or 150 MB in total per assessment.
• Each upload is checked after storage for declared type against actual file signature, macro-bearing Office content, embedded executables and PDF JavaScript. Files that fail are quarantined and cannot be downloaded by reviewers.
• Upload requests are rate limited per invitation, and uploads that are never registered against an answer are deleted automatically.
• This structural inspection reduces obvious risk. It is not a full anti-malware guarantee, and reviewers should still open supplier files with normal caution.

Retention and deletion

Assessment records, responses and evidence are retained for as long as the customer keeps them in their workspace, so that the approval decision remains defensible. Customers can offboard a supplier, which archives the supplier and revokes any outstanding invitation links while preserving the assessment history.

Where a supplier or a customer needs assessment material removed, the request should come through the requesting company; VendorLens deletes workspace data on customer instruction and on account closure, subject to the retention periods in the Privacy Policy and Terms.

What the assessment module does not do

• It does not verify, audit or certify a supplier’s controls — it collects and records what the supplier states and attaches.
• It does not monitor suppliers continuously and provides no security ratings, external scanning or breach feeds.
• Inherent-risk scoring is a structured aid based on the customer’s own exposure answers, not an assurance opinion.

HTTPS and transport protection

VendorLens marketing pages, application pages and customer trust portals are served over HTTPS. Custom-domain certificates are provisioned through the platform's Cloudflare configuration. Data transmitted between a supported browser and VendorLens is protected using current TLS-based transport security.

Application data, authentication and file storage

VendorLens uses Supabase for core database, authentication and storage services. Access to account data and uploaded material is mediated through the VendorLens application and its configured authorisation rules.

Specific hosting locations, retention arrangements or customer data-flow questions can be raised through privacy@vendorlens.io or during a customer security review.

Edge delivery and network protection

VendorLens uses Cloudflare for public web delivery, DNS, HTTPS termination and edge-level network protection. These controls help protect the public service from common web and network threats. Cloudflare's controls and certifications apply to Cloudflare's services; they do not constitute a VendorLens certification.

Payments

Subscription payments are processed by Stripe. VendorLens receives the information needed to manage the subscription but does not store complete payment-card details in its own application database.

Transactional communications

VendorLens uses specialist providers for transactional email, e-signature workflows and customer communications where those features are enabled. Customers should review the Privacy Policy and applicable contractual documentation for the current processing context.

Administrative access

Access to production services is limited to authorised members of the VendorLens team. Administrative access should be granted on a need-to-operate basis and removed when it is no longer required.

Customer workspace roles

VendorLens workspaces support defined user roles for managing content and reviewing activity. Customers remain responsible for inviting the correct people, assigning appropriate roles and removing access when someone leaves their organisation or changes responsibilities.

Secrets and service credentials

Production credentials and integration secrets must be held in access-controlled provider configuration rather than exposed in public code or customer-facing pages. Integration credentials supplied by customers are used only to provide the configured integration.

Changes to the service

Application changes are managed through version-controlled code and a controlled cloud deployment process. Security-relevant changes should be reviewed against their impact on authentication, authorisation, document access, logging and customer data.

Service resilience

VendorLens relies on the resilience and recovery capabilities of its managed infrastructure together with its own operational procedures. We do not publish a backup frequency, recovery-time objective, recovery-point objective or availability commitment on this page unless it has been formally defined, tested and included in the applicable customer agreement.

Customers with specific resilience requirements should contact security@vendorlens.io before relying on a particular recovery or availability target.

Our role

VendorLens Technologies Ltd acts as a controller for information needed to operate accounts, billing, support, analytics and the VendorLens service. Depending on how a customer uses the platform, VendorLens may also process personal data submitted by that customer on the customer's instructions.

Our Privacy Policy explains the categories of personal data we process, the purposes, legal bases, recipients, international-transfer considerations, retention approach and data-subject contact routes.

Why we do not use "GDPR compliant" as a badge

VendorLens does not use "GDPR compliant" as a standalone security badge. Compliance depends on the processing context, contracts, instructions, data and conduct of the relevant organisations. We describe our role and measures, and customers remain responsible for ensuring that material they upload and disclose through VendorLens is lawful and appropriate.

How we respond

VendorLens investigates suspected security events affecting its service, accounts or customer data. The response depends on the nature and scope of the event and may include containment, access revocation, investigation, recovery and corrective action.

Where a confirmed incident creates a legal or contractual notification obligation, VendorLens will communicate with affected customers in accordance with the applicable requirement. This page does not create a separate notification deadline or service-level commitment.

If you believe an account or document has been accessed improperly

• Contact security@vendorlens.io.
• Include the affected account, portal or document, but do not email passwords, private keys or complete sensitive documents.
• Describe what you observed and when you observed it.
• Revoke active document approvals or remove affected workspace users where you can do so safely.

Email security@vendorlens.io with

• The affected URL, feature or integration.
• A clear description of the issue and its likely impact.
• Reproduction steps or a minimal proof of concept.
• Any steps already taken that may have changed data or system state.
• A safe way to contact you with follow-up questions.

Please do not

• Access, modify or download data that does not belong to you.
• Use social engineering, denial-of-service techniques or destructive testing.
• Upload malware or attempt to establish persistence.
• Publish an unresolved issue before VendorLens has had a reasonable opportunity to investigate.
• Include secrets, credentials or complete confidential documents in the initial email.

No formal bug-bounty programme

VendorLens does not currently operate a formal public bug-bounty programme, and submission does not guarantee payment or reward. We will review good-faith reports and respond as practical based on severity and available information.

Customers should

• Upload only material they are authorised to store and disclose.
• Keep credentials, private keys, raw vulnerability data and customer data out of the trust center unless there is a documented and approved reason to process them.
• Use public visibility only for documents intended for unrestricted distribution.
• Review restricted-document requests before approving them.
• Remove former employees and unnecessary workspace access promptly.
• Keep reports, certificates, policies and subprocessors current.
• Revoke access where a request was approved in error or is no longer required.
• Maintain their own copies, records and recovery processes for source documents.

The limits of any access-control system

No access-control system can prevent an authorised recipient from photographing, copying or redistributing information they can legitimately view. Watermarks, expiry and activity history reduce risk and improve accountability; they do not eliminate the recipient's ability to misuse a downloaded document.