This is the list a security reviewer can check against the product that is running today. Every line in the control groups on this page is implemented. The paragraphs here say what those lines mean in practice: what is enforced, where a session actually ends, and what happens to a bid record. The downloadable brief is the same material, written so it can sit next to a questionnaire. If a control you need is not here, ask. We would rather say so on a call than have you find the gap three weeks into an evaluation. This page does not describe certifications that are not held, and it does not describe controls that have not shipped.
Passwords are hashed with bcrypt and a per-user salt before they are stored. That includes a reset, not only the first registration. The minimum length is 10 characters. Access tokens are short-lived JWTs, and verification pins the signing algorithm, so a token presented with a swapped algorithm is rejected rather than trusted. The token carries identity only. It does not carry a workspace role. Refresh tokens are random, stored on the server, rotated whenever they are used, and cleared on logout. Clearing the server-side token ends the session even if the browser still has a copy. The server refuses to start if the signing secret is missing, still a placeholder, or shorter than 32 characters. A misconfigured deployment fails closed. It does not boot with a secret an outsider could guess. Live connections authenticate with the same identity check when they connect. There is no unauthenticated socket beside the API.
Workspace permissions are read from the database on every request. Removing someone takes effect on their next request, even if their access token has not expired, because membership is not stored inside the token. Routes check a capability, such as managing members, rather than a hardcoded role name. A custom role receives only the permissions it was granted. Buyers reach their own events. Suppliers reach the events they were invited to. The same participation check applies to live updates, not only to ordinary page loads, so a socket cannot be used to read around the page. What one bidder is allowed to see of another bidder is a setting on the event, and that setting has its own tests.
Supplier onboarding packs are commercially sensitive and often personally sensitive: director identity documents, bank letters, tax clearances. They cannot be fetched by guessing a file URL. A document is served only after the request is checked against that specific caller and that specific file. Uploaded files are not available to anonymous visitors. The extension we store is taken from the detected type of the file, not from the filename the uploader typed. The same upload rules apply on every way a file can enter, including files sent inside a message.
The audit trail is hash-chained. Each entry carries a hash of the previous entry and of itself. A verification check recomputes the chain and reports the first position where it breaks, so a reviewer can do that rather than trust a screenshot of a log. The evidence pack exports to Excel without the reviewer having to stay inside the product. Logs carry a correlation id, so one action can be followed from the page request through to the live connection. Bids, messages, awards and changes are on that trail. Export of the commercial record is also available as PDF or ZIP from the event itself.
No model chooses a price, a concession or an award. Those numbers come from a deterministic rules engine, using the target, the floor and the bids in the event. Each of those decisions can be audited. A language layer that drafts the wording of a supplier message is off unless a key is configured, and the product runs in full with that layer off. When the layer is on, what it receives is narrow. It does not receive the documents and it does not receive the bid history, and it does not decide the number that goes into the message. Events, bids and price history are not used to train a model, ours or a provider's. They are not pooled with other customers and they are not sold back as a benchmark index.
Account data — profile, workspace membership, preferences — is kept while the account is active. A deletion request starts a 30-day grace period and is cancelled if the person logs back in during it. Completed event records are kept for two years and then anonymised: supplier identifiers come off, and the commercial history can remain. Chat and negotiation messages are deleted by a scheduled sweep at two years. The sweep is what enforces the schedule. A written policy that nobody runs does not. Export of your own data, and erasure, are self-service routes. They are not a manual queue with a target response time. Consent for analytics is stored with a version of the notice the person accepted, and analytics storage stays off until they allow it.
Email hi@supernegotiate.com to ask for the brief, or use the form on this page. The link in that mail works for 30 days and can be forwarded to whoever is running the review. One mail, with the document. It is not a marketing list. To report a vulnerability, use the same address and include steps to reproduce. We acknowledge security reports within two business days. We will not pursue good-faith research that stays in a test workspace, avoids other customers' data, and gives us a chance to fix the issue before it is published. The support page is the right door for a buyer or a supplier who is stuck in an event. The pricing page is the right door for seat caps. Neither of those changes the controls above.
SuperNegotiate — the procurement operating system