Access control
Role-based access separates buyer, evaluator, supplier and administrative activity. Access is granted against an organisation and recorded.
Security · assurance · buyer due diligence
Enterprise and public-sector buyers need evidence they can test. We provide service-specific due-diligence information and describe current controls as they operate. We do not present a certification as held until it has been independently awarded.
Request due-diligence informationRole-based access separates buyer, evaluator, supplier and administrative activity. Access is granted against an organisation and recorded.
Account verification, session controls and multi-factor authentication support reduce the risk of unauthorised access.
Material procurement actions retain the actor, time and associated record so decision history can be reviewed.
Multi-client deployments retain separate client workspaces, supplier records, exercises, evaluators and audit history.
Procurement notices pass through validation and an explicit release step. A timeout is treated as an unknown outcome that must be checked.
Data protection, hosting, retention, subprocessors and deletion requirements are addressed during buyer due diligence and contracting.
Evidence pack
The appropriate evidence depends on the service scope, information processed, integrations and contractual route. We agree that scope first rather than publishing generic assurances that may not apply.
Send the questionnaire, service scope and deadline. We will confirm what can be supplied and any confidentiality requirements.
Talk to the team