Identity
Confirmed email required
Buyer and supplier private actions require an authenticated, email-confirmed account or a scoped invite.
Buyer security review
Security and data handling.
An implementation-level summary of the controls protecting buyer workspaces, supplier evidence, connector credentials, and billing boundaries in the current XveriTrade service.
Last reviewed: August 10, 2026
Workspace records
Buyer scoped
Policies, evidence reviews, decisions, and audit reads are constrained to the owning buyer relationship.
Connector credentials
Authenticated encryption
Provider tokens are encrypted with AES-256-GCM before database storage and are never rendered publicly.
Payment details
Stripe hosted
Stripe collects card and billing details. XveriTrade does not receive or store full card numbers or security codes.
Implemented controls
Protection follows the workflow boundary.
The public supplier signal surface stays separate from private buyer evidence, decisions, audit records, and connector credentials.
01
Access and isolation
- Private buyer access requires an authenticated, email-confirmed session.
- Buyer workflow reads and writes include the owning buyer identifier rather than relying on a public record id alone.
- Supplier evidence submission is restricted to a scoped, expiring invite and the invited email address.
- Database policies keep private workflow and pilot-application tables unavailable to public, anonymous, and ordinary authenticated clients.
02
Application boundaries
- Private app, invite, claim, supplier, operations, API, and post-checkout routes are excluded from search indexing.
- Private responses use no-store controls; public responses enforce HSTS, frame denial, MIME sniffing protection, and a restrictive content security policy.
- Supplier-provided document and website destinations must use HTTPS, and application redirects are constrained to internal paths.
- State-changing workflow operations use constrained database functions so related records and audit events commit together.
03
Integrations and secrets
- Provider webhook ingestion requires a verified signature before accepted evidence can be recorded.
- OAuth connection state is short-lived and bound to the initiating supplier account.
- Stored connector access and refresh tokens use application-level AES-256-GCM authenticated encryption.
- Server logging redacts credential-shaped fields and known secret formats before operational errors are written.
04
Minimization and operations
- Public conversion analytics contain event names only and exclude contact, organization, workflow, campaign, and payment fields.
- Pilot intake rate limiting stores a keyed pseudonymous network fingerprint rather than a raw network address.
- Release checks cover dependencies, secret hygiene, types, tests, production builds, database migrations, browser workflows, and live response controls.
- A standards-based security contact is published at /.well-known/security.txt.
Service roles
Current operating providers.
These providers support the live service. Product-specific data residency, contractual, or subprocessor requirements should be confirmed during a buyer review rather than inferred from this list.
- Vercel
- Application hosting and field-free web analytics
- Supabase
- Authentication, database, and private workflow storage
- Resend
- Transactional product email delivery
- Zoho
- XveriTrade support mailbox
- Stripe
- Hosted subscription checkout, tax inputs, and billing records
Current assurance boundary
No certification claim by implication.
XveriTrade does not currently claim SOC 2 or ISO 27001 certification or an independent penetration-test attestation. It also does not independently authenticate supplier-submitted documents.
A buyer that requires a DPA, security questionnaire, specific data residency, contractual security terms, or external assurance should raise that requirement before pilot acceptance. No certification, location, or contractual commitment is assumed until confirmed in writing.
Procurement-ready questions
Review the real workflow and its controls.
Use the 30-day guided pilot to test one buyer-owned approval process. Bring any security requirement that could affect pilot scope before activation.