Current assurance reference
CurrentISO 27001-certified delivery operations
A formal information-security reference for the teams delivering VendrNova’s enterprise procurement work.
Status note
Certified delivery operations
Enterprise buyer brief · VendrNova
Trust center
Confidence for the buying room.
A practical view of VendrNova’s current security, privacy, and assurance posture—built for the procurement, IT, security, and legal teams evaluating enterprise software.
Current status, clearly labeledBuilt around procurement reality
Operational context
VendrNova posture
Clear answers for complex procurement.
ISO 27001
Delivery ops
GDPR
Data practices
SOC 2 Type II
Audit underway
01 · Current posture
What is true today, at a glance.
Trust is easier to evaluate when completed work and work in progress are not presented as the same thing. VendrNova’s current references are shown below with plain status language.
The short version
ISO 27001-certified delivery operations and GDPR-compliant data practices are current references. The SOC 2 Type II audit is underway.
Current data position
CurrentGDPR-compliant data practices
Privacy-conscious data practices for information shared through the VendrNova experience.
Status note
Privacy-conscious practices
Audit program
In progressSOC 2 Type II audit underway
An active audit program focused on the controls enterprise buyers expect to review; it is not presented as a completed certification.
Status note
In progress · not a completed certification
Assurance language on this page is intentionally scoped to the current VendrNova references above.
02 · Security approach
Review the work, not just the label.
Enterprise procurement is a chain of requests, suppliers, contracts, purchasing, invoices, and decisions. A useful review follows that chain and keeps the people, systems, and evidence in view.
Scope the pathStart with the workflow and information your organization will actually bring into the conversation.
Keep the context connectedFrame security, privacy, and assurance questions around the operating reality behind the purchase.
Mark maturity honestlyDistinguish a current reference from an audit that is still underway so the next decision has the right context.
Evidence in context01 / 03
A clearer review
The right answer depends on the workflow in scope.
Privacy + compliance
Keep the information and its purpose in view.
03 · Privacy & compliance
Privacy and compliance, in plain view.
The useful question is not only what data exists. It is why that information is in the workflow, who needs the context, and which decision it supports.
Privacy
Privacy-first Approach
We’re committed to the protection of customers’ data and maintain a high level of information security. We make it a priority to keep your data secure and prevent unauthorized access. We accomplish this by keeping privacy and security on the forefront of our mind when developing all of our products.
Compliance
Compliance
We undergo regular external audits to ensure our internal systems and controls comply with the stringent data protection and security frameworks. Our certifications testify to our commitment to safeguarding customer data and building trust with AI systems.
ISO 27001
Current certification reference
GDPR
Current data-practice reference
04 · Cybersecurity
Security controls you can scan quickly.
A simple four-layer view of the practices that protect customer information, the product, and the people who operate it.
01 · Infrastructure02 · Application03 · Access04 · Operations
Control map
Designed to be read layer by layer.
Layer 01
Infrastructure security
Data Encryption
We encrypt our customers’ data with TLS 1.2+ in transit and AES-256 at rest. Our administrative controls enforce protection at every level of the organization.
Customer Data Segregation
We’ve distinct controls in place to prevent data leakage. Development, Testing, and Production environments are all isolated to keep data where it belongs.
Firewall Controls
Subnet and security group rules are leveraged to control network traffic. All components that process your data operate in our private network inside our secure cloud platform. Application-level ingress and egress filtering are implemented to control inbound and outgoing traffic. Our servers and network ports are behind load balancers and a web application firewall.
Layer 02
Application Security
Security in Software Development & Deployment Process
We use secure SDLC processes, including threat modeling, design reviews, code reviews, SCA. Manual QA are implemented to keep the product free of bugs. We also leverage up-to-date and secure open-source frameworks with security controls to limit exposure to OWASP Top 10 security risks. These controls reduce our exposure to SQL Injection (SQLi), Cross Site Scripting (XSS), and Cross Site Request Forgery (CSRF).
Penetration Testing
We actively work to identify and fix security vulnerabilities in our product and infrastructure. That’s why we undergo third-party network penetration tests on a routine basis.
Information Security Awareness & Training
Our employees complete mandatory annual training on a wide range of privacy and security topics. Training targets phishing, escalating issues, insider threats, and malware. It is also updated on a regular basis to stay up to date with industry security changes.
Layer 03
Access Controls
SSO Integration
We offer SSO integration with any SAML-based IdP.
Role/Permissions Based Access
Our customers can configure users and their respective permissions in any secure form they seek. We can assign privileges by role, department, and group as per requirements.
Audit Logging & Tracking
We maintain audit logs for actions taken by any user. This includes the date/time stamp, user, and the action taken.
Layer 04
Operational Security
Zero-Trust Model for Production Access
We carefully authenticate and authorize all users and devices before granting access to production resources. Security measures are consistently applied across the network.
Background Checks
We conduct background checks on all employees, vendors, and contractors who work with us or have any access to data.
Device Endpoint Security
Mobile Device Management (MDM) is configured to enforce security for all employee devices. Enterprise anti-malware is installed to provide alerts on potential viruses to prevent data leakage.
05 · Buyer review
A practical path from checklist to next question.
Use this sequence to keep a multi-team evaluation clear, specific, and grounded in the way your enterprise intends to work.
The best security conversation is specific enough to be useful and honest enough to show where follow-up still belongs.
01
Define the flow
Name the request, supplier, contract, purchasing, invoice, or spend path that will be evaluated.
02
Map the owners
Bring procurement, IT, security, privacy, legal, finance, and business stakeholders into one view.
03
Review the evidence
Separate current assurance from work underway, then keep each answer tied to the right scope.
04
Agree the next question
Carry open items into the right conversation instead of burying them in a generic checklist.
Bring the right people in
One review. Four useful lenses.
Give every stakeholder a clear place to start, then connect the answers around the same procurement flow.
Procurement & business
Which workflows, entities, suppliers, and buying decisions are in scope?
Security & IT
Which integration, access, and operational questions need a focused review?
Privacy & legal
Which information, processing purposes, and contractual questions apply?
Finance & audit
Which approvals, commitments, exceptions, and evidence must stay visible?
06 · Vulnerability reporting & disclosure
Make the signal easy to send.
A clear reporting path helps the right people investigate a concern and keep the next step visible.
Security is a top priority for us, and we continuously work with skilled security researchers and third party testers to identify weaknesses in our products and infrastructure. If you believe you have found a security vulnerability, please let us know right away here. We investigate all reports and do our best to quickly fix valid issues.
Contact the teamDisclosure path
01
Report
Send a suspected vulnerability to the VendrNova team.
02
Investigate
The report is reviewed with the relevant product and infrastructure context.
03
Fix
Valid issues are prioritized so the team can work toward a quick fix.
Questions are welcome
Ready for the questions behind the RFP?
Bring the workflow, stakeholders, and information in scope to the VendrNova team. We can continue the conversation in the context your enterprise actually needs.