Collect less
The template needs approved amounts, dates, currencies and matching references. It does not need bank details, personal contacts, product descriptions or your full ledger.
SECURITY & DATA HANDLING
Your records.
A clearly agreed boundary.
You should know what is needed, who can access it and what happens afterwards. Start with the fictional demo, without sharing financial records.
Current service stage: public demonstration.
A real-data pilot is invitation-only and must pass an environment-specific review before activation. This page describes current website controls and the conditions for a future client pilot.
Prepare locally
The preparation tool replaces names and identifiers in your browser. A downloadable offline version blocks network requests. You keep the private mapping.
Human decisions
Findings show potential discrepancies for your team to verify. There are no payments, ERP writes or automatic supplier emails.
What crosses which boundary?
| Stage | What is used | Where it goes |
|---|---|---|
| Explore the demo | Fictional records | Displayed in your browser; edits reset on reload. |
| Prepare an export | Your approved CSV | Processed on your device. The tool does not upload the file or its mapping. |
| Send an enquiry | Business contact details | When enabled, the form sends via this application and Hostinger email to our fixed mailbox. Otherwise you can copy the enquiry and send it with your own email. |
| Approved client pilot | Agreed, minimized records | Only through a separately approved workspace and handling agreement. |
Pseudonymised does not mean anonymous.
Supplier names and document numbers can become codes, such as SUP-0001 and RMA-0001. Your company retains the lookup table. Dates, currencies, amounts and transaction patterns remain visible and may still identify a business or person. Protect the coded file as confidential. Never share the private mapping with us as part of an ordinary pilot.
The European Commission explains why re-identifiable personal data remains personal data. Coding is also not encryption. The offline tool does not protect a compromised device, downloaded files or copies stored in device backups.
Explore the preparation toolControls and evidence.
| Area | Current position |
|---|---|
| Public website | HTTPS, restricted content policy, anti-framing and MIME protections. No advertising pixels or third-party analytics scripts in this release. |
| Financial uploads | No public upload endpoint. File selection in the local tool stays on the device; it is not a server upload. |
| Accounts and isolation | Server-held sessions, organization checks and row-level policies exist in the pilot code. Hosted configuration and cross-client access tests are required before use. |
| Storage and encryption | The exact client-data host, region, encryption at rest, backups and administrator access must be documented for the pilot. HTTPS does not establish those guarantees. |
| AI use | The application makes no AI API calls. Reconciliation is deterministic. Any future AI processing would require a separately reviewed workflow and client agreement. |
| Certifications and review | No VendorCredits SOC 2 or ISO 27001 certification, independent penetration-test pass or “bank-grade” assurance is claimed. A hosting provider’s certification is not our certification. |
Before your first real-data pilot.
- Confirm the contracting operator, finance owner, purpose and approved dataset.
- Agree confidentiality and, where applicable, data-processing terms, including actual processors and transfer arrangements.
- Verify named access, account security, client separation, storage location and encryption configuration.
- Set a retention period, deletion owner and backup expiry. Test restoration and record what deletion can and cannot remove immediately.
- Agree incident contacts and support access, then authorize the transfer method. An environment flag alone is not evidence of these checks.
No fixed deletion SLA, EU-only storage guarantee or zero-access claim is made before those details are verified. Authorized hosting, database or support administrators may be able to access an enabled pilot; any such access must be identified and controlled.
Ask the difficult questions early.
We can discuss the required fields and review scope without seeing your actual ledger. Use a synthetic example, then review the client data-handling brief with your finance or IT colleague. Agree an NDA where appropriate; it supports confidentiality but does not replace technical controls.
For security or privacy questions, contact office@vendorcredits.com. Do not include passwords, access keys or financial exports.
Start with the process.
No financial attachment is needed to discuss whether VendorCredits fits your team.
Discuss scope and data handling