← VendorScore

VendorScore Security Overview

Last updated: August 31, 2026

VendorScore helps organizations manage vendor risk in a Federal Contract Information (FCI) environment. This page describes the security controls actually in place today. We've deliberately included a section near the end listing what we don't claim yet — a security page that only lists strengths isn't one you should trust, including this one.

Infrastructure & Hosting

VendorScore runs on Railway, which holds a SOC 2 Type II attestation covering its infrastructure, including tested encryption of data at rest. This is Railway's certification, as our infrastructure subprocessor — not an independent certification of VendorScore itself (see "What We Don't Claim Yet" below).

Tenant Isolation

Every customer's data lives in the same database, separated by row-level security (RLS) policies enforced at the database layer — not application-layer filtering that a bug could bypass. The application's own database role runs with NOSUPERUSER and NOBYPASSRLS: it cannot circumvent these policies even if application code tried to. This isn't a design intention we're describing — it's a property we can verify directly against the running database at any time.

Access policies are scoped by organization and role: a customer's administrators and users can only read and write data belonging to their own organization; a vendor's portal users can only see what has been shared with them.

Authentication & Access Control

  • Multi-factor authentication is available for all accounts, using TOTP (any standard authenticator app) with one-time backup recovery codes for account recovery.
  • Role-based access control — four distinct roles (platform administrator, client administrator, client user, vendor user), each with access scoped to what that role needs.
  • Sessions are managed server-side; credentials are never exposed to client-side code.

Document Handling

Uploaded documents are validated against their actual file contents, not just a client-supplied file-type label — a PDF upload is checked for a genuine PDF file signature before it's accepted, closing off a trivial way to disguise a different file type as a PDF.

Documents are stored in Cloudflare R2, accessed only through short-lived, single-purpose signed URLs generated on demand — there is no persistent public link to any uploaded document.

Audit Logging

Security-relevant actions — role changes, document uploads and deletions, assessment activity, and administrative actions — are recorded in an audit log. That log is append-only by design: there is no delete capability for any role, including our own platform administrators. Once an event is recorded, it stays recorded.

Backups & Continuity

The production database uses point-in-time recovery (PITR) backed by continuous write-ahead log (WAL) archiving, allowing recovery to a specific point in time rather than only to the most recent daily snapshot.

What We Don't Claim Yet

We'd rather this list be short and accurate than long and generous with itself:

  • No independent security certification of VendorScore itself. We rely on Railway's SOC 2 Type II as our infrastructure subprocessor (above); VendorScore as a company has not completed its own SOC 2, ISO 27001, or equivalent audit.
  • No completed third-party penetration test of the application has been performed to date.
  • No uptime SLA. The application runs as a single instance today, without redundant replicas. We don't offer service credits or uptime guarantees at this time.
  • No automated malware scanning is active on uploaded files today. The application has a scanning integration point built in, designed to fail closed (an unscanned file cannot reach storage if a scanner is configured and unavailable), but no scanning provider is currently connected. File-type validation (above) is active; content-level malware scanning is not, yet.

If any of these matter to your evaluation, ask us directly — we'll give you a straight answer either way.

Compliance Context

VendorScore is designed for FCI-capable use. Controlled Unclassified Information (CUI) must not be uploaded to the platform — see our Acceptable Use Policy. One specific, narrow automated control exists today: uploaded prime contract documents are scanned for text patterns matching common CUI/export-control markings as part of contract analysis, and a match halts that document's analysis for manual review rather than proceeding automatically. This detection currently covers only prime contract documents processed through contract analysis — it does not run against credentials, evidence, vendor contracts, NDAs, or agreement uploads. The prohibition on uploading CUI applies to all document types regardless of what is or isn't automatically scanned; see our Acceptable Use Policy for the full policy.

Reporting a Security Issue

If you believe you've found a security vulnerability in VendorScore, please tell us before disclosing it publicly. Email info@praetoriansecure.com with what you found and how to reproduce it. We'll acknowledge your report and keep you updated as we investigate.