Trust at VendorVett

We sell due diligence, so we expect our customers to run it on us. This page answers the questions a security review asks first; for anything else, email security@vendorvett.com.

• Reproducible scoring

  Every risk score is computed by a deterministic engine and shown with its working: the same answers always give the same score, and a reader can recompute it by hand. AI drafts narratives for review; it never produces a score.

• Tamper-evident audit trail

  Every change is appended to a per-organization, hash-chained log. Altering or removing any entry breaks every digest after it, and owners can verify the chain at any time.

• Verifiable evidence receipts

  On the Business plan, an assessment and its evidence can be exported as an Ed25519-signed receipt that anyone can check at vendorvett.com/verify without an account.

• Tenant isolation

  Every request is scoped to one organization on the server, and an automated suite tries to cross tenants on every change. Roles (owner, analyst, viewer) are enforced by the API, not just the interface.

• Encryption and file safety

  TLS in transit; documents encrypted at rest in private storage and reachable only through short-lived signed links. Every upload is virus-scanned. A file the scanner flags is quarantined and cannot be downloaded; a file that could not be scanned is flagged and needs explicit confirmation to download.

• Staff access

  Our admin console requires a second factor, locks out repeated failures and logs every support action. Support can view a customer account only through a time-limited, read-only session that the customer's screen clearly labels.

• Backups

  Scheduled database backups to private object storage outside our hosting platform, and a restore drill that loads the newest backup into a scratch database and checks every audit chain, are built and being switched on. This page will say so once they run on schedule.

• Your data rights

  Owners can export everything as a ZIP with a SHA-256 manifest, and delete their organization with a 30-day grace window. Payment failures never delete data.