Skip to content
ERP Preflight
Vendor risk assessment

Procurement documentation

Security, architecture and legal documentation for your vendor risk assessment. The documents are sent by email on request.

Data residency
European Union (Frankfurt)
Hosted in the EU
Tenant isolation
PostgreSQL row-level security
Enforced on every tenant query
Antivirus check
ClamAV
Uploads are only analyzed after a clean scan
Supply chain
Dependency inventory
Available on request
Security and compliance

Information security overview

Tenant isolation with PostgreSQL row-level security, upload quarantine and antivirus check, and authentication controls.

Key points

  • Row-level security bound to the current organization on every tenant query
  • Argon2id password hashing
  • ClamAV scan of every upload before analysis (fail-closed when the scanner is enabled)
  • Optional two-factor authentication and organization-wide 2FA enforcement
Request document
Architecture and infrastructure

Architecture and data flow

How browser, web frontend, API, job queue and the stateless analysis service interact.

Key points

  • Strict service boundaries: web → API → job queue → analysis service
  • The analysis service has no access to the application database
  • Short-lived pre-signed upload URLs (at most 15 minutes)
  • Containers run as a non-root user
Request document
Privacy and data protection

Subprocessor directory

Hosting providers, storage regions and optional subprocessors.

Key points

  • Hosting in the European Union (Frankfurt)
  • Artifact storage separated per organization and project
  • AI providers are only used when the organization enables AI assistance
Request document
Legal and procurement

Data processing agreement (DPA) template

GDPR data processing agreement including standard contractual clauses.

Key points

  • You keep full ownership of all analyzed SAP artifacts
  • Artifacts are deleted when a project or organization is deleted, subject to your retention settings
  • Analyses can run without any AI assistance
Request document
Software supply chain

Software dependency inventory

Inventory of direct and transitive dependencies with license information.

Key points

  • Lockfile-verified installs for all workspace packages
  • One curated library per concern, enforced by an automated check
Request document
Procurement documentation: security, architecture and legal