Security & Trust

Your vendor data is safe
with Vendor IQ™

We built VIQ for business owners who can't afford a data breach. Every layer of the platform — from password hashing to Stripe payments — is designed with security first.

🔐
PBKDF2 Hashing
100,000 iterations, 16-byte salt — industry best practice
💳
PCI via Stripe
We never see, store, or touch your card number
🔒
TLS Everywhere
All data in transit encrypted with TLS 1.3
🛡️
No Data Selling
Your vendor data is never sold or shared with third parties
🌍
GDPR / CCPA Ready
Right to access, export, and delete your data — always
Security by design
Every component of VIQ was built with the assumption that it could be attacked.

Password Security

Passwords are hashed using PBKDF2-SHA-256 with 100,000 iterations and a unique 16-byte random salt per user — computed in our Cloudflare Worker, never in the browser.

  • Zero plaintext passwords stored anywhere
  • Server-side hashing via Cloudflare Worker
  • Legacy btoa passwords auto-migrated on first login
  • Password reset requires a time-limited secure token

Payment Security

All payment processing is handled end-to-end by Stripe. VIQ never receives, processes, or stores any credit card data.

  • Stripe Payment Links — card details never touch our servers
  • Webhook signatures verified with HMAC-SHA256
  • 5-minute replay window on all webhook events
  • Stripe secret key stored as Worker secret — never in browser code

Session & Token Security

User sessions are signed JWT tokens issued by our Cloudflare Worker using HMAC-SHA-256. Tokens expire after 30 days.

  • HMAC-SHA256 signed JWTs — tamper-evident
  • JWT_SECRET stored as Worker secret — never in client code
  • Tier/role written server-side only — no client-side elevation
  • Logout clears JWT and session data immediately

Network & Transport

All traffic between your browser, our platform, and third-party APIs runs over TLS 1.3. Our Cloudflare Worker enforces strict CORS origin controls.

  • TLS 1.3 enforced on all connections
  • CORS locked to viq.vendorintel.ai origin
  • Cloudflare DDoS protection on all endpoints
  • API keys (Resend, Stripe, Plaid) stored as Worker secrets only

Data Storage

Your vendor and business data is stored in our RESTful database, served over HTTPS. Database access is scoped to your account via session credentials.

  • Data at rest encrypted by storage provider
  • Vendor records are private by default — no public access
  • Shareable reports require explicit opt-in per vendor
  • Soft-delete on all records — data recoverable within 30 days

Privacy & Data Use

Your vendor spend data is used exclusively to power your VIQ scores. We do not sell, license, or share individual business data with any third party.

  • No advertising tracking on authenticated pages
  • Cloudflare Web Analytics — cookieless, GDPR compliant
  • Email sent via Resend using your own domain
  • Bank/QuickBooks data stays in your session — never logged
How your data flows
From browser to score — every step secured.
🖥️
Your Browser
Vendor data entered locally. No data logged until you submit.
HTTPS
⚡
Cloudflare Worker
Password hashing, JWT signing, Stripe webhook verification.
HMAC-SHA256
🗄️
Database
Encrypted at rest. Row-level scoping by account ID.
Encrypted
📊
Scoring Engine
Client-side scoring — your raw spend data never leaves your session.
In-Browser
✅
Your VIQ Score
Scores stored in your account — private by default.
Private
Compliance & certifications
Where we stand today, and where we're headed.
Standard / Framework Status Details
TLS 1.3 Encryption Live All connections encrypted via Cloudflare's TLS 1.3 termination
PBKDF2 Password Hashing Live 100k iterations, 16-byte salt, SHA-256 — NIST-recommended
Stripe PCI-DSS Live Card data handled exclusively by Stripe (PCI Level 1 certified)
GDPR Compliance Live Right to access, export, and delete data — contact hello@vendorintel.ai
CCPA Compliance Live California residents: opt-out and deletion rights honored
Cookieless Analytics Live Cloudflare Web Analytics — no third-party cookies, GDPR compliant
JWT Token Authentication Live HMAC-SHA256 signed tokens, 30-day expiry, server-verified
SOC 2 Type II In Progress Audit preparation underway — expected completion Q4 2026
Penetration Testing Planned Scheduled as part of SOC 2 audit preparation
HIPAA N/A VIQ does not process health data — not applicable
Responsible disclosure
Found a security issue? We take all reports seriously and respond within 24 hours.
📧
Report via Email
Send details of any vulnerability, suspected breach, or security concern directly to our security team.
security@vendorintel.ai →
⏱️
Response SLA
We acknowledge all reports within 24 hours, provide a status update within 72 hours, and patch critical vulnerabilities within 7 days.
🤝
Our Commitment
We will not pursue legal action against good-faith security researchers. We credit researchers publicly (with permission) and aim to fix all valid findings.
Security FAQ
Answers to the questions we get most often.
No. Your vendor data is yours. We use it only to generate your VIQ scores and power the features you explicitly use. We do not sell, license, or share individual business or vendor data with any third party, advertiser, or data broker. Ever.
Your data is stored in our RESTful database hosted on Cloudflare's global infrastructure, encrypted at rest. Authentication and sensitive operations run through Cloudflare Workers — a V8 isolate-based serverless environment with no persistent disk access.
QuickBooks connections use OAuth 2.0 — you authorize VIQ through Intuit's official flow and can revoke access anytime. Plaid bank connections use Plaid's Link widget (a sandboxed iFrame) and return tokenized access. Neither your QuickBooks credentials nor your online banking login are ever seen or stored by VIQ.
Yes. Email hello@vendorintel.ai with your account email and we will permanently delete all your records within 5 business days. You can also export your data at any time from Account Settings.
Yes. VIQ is already used by multi-unit franchise operators and franchise brands. Role-based access (Owner, Admin, Analyst, Read Only) lets you control exactly who sees what. We're working toward SOC 2 Type II certification in Q4 2026 for customers with formal compliance requirements.
In the event of a confirmed breach, we will notify all affected users by email within 72 hours with details of what was affected and what action to take. We maintain an incident log and will publish a post-mortem on our status page for any significant event.
🔏
Vendor Confidentiality Promise

Your vendor data is never shared with vendors.

When you use VIQ to score, benchmark, or flag a vendor, that vendor is never notified, contacted, or given access to your data or your scores. Your spend amounts, contract terms, risk ratings, and negotiation notes are visible only to you and the team members you explicitly authorize.

VIQ does not aggregate, anonymize, or resell individual vendor performance data to any party — including the vendors being evaluated. We do not accept payment from vendors for score visibility, preferential ranking, or any other placement. Our only customer is you.

Vendors can't see their score
VIQ scores are private to your account. No vendor can look themselves up, request their rating, or be notified a score exists.
No vendor advertising or pay-to-rank
We don't sell ad placements, sponsored rankings, or "certified vendor" badges. Scores reflect your data alone.
Your negotiation leverage stays yours
Benchmarks, overpay estimates, and renegotiation notes are your strategic advantage — never exposed to the other side of the table.

Start scoring your vendors today

No credit card required. Your data is protected from day one.

Start Free — No Card Required Contact Security Team
PBKDF2 Password Hashing Stripe PCI-DSS TLS 1.3 GDPR & CCPA Ready SOC 2 In Progress