How Vederca handles your data

Where data is held

The application, its database and uploaded files run on Amazon Web Services in the Sydney region (ap-southeast-2). The website itself is delivered through Amazon CloudFront.

Encryption

• In transit: all traffic to Vederca uses HTTPS, with TLS 1.2 or later. Older protocol versions are turned off.
• At rest: the database (Amazon RDS) is encrypted with keys managed in AWS Key Management Service, and uploaded files (Amazon EFS) and stored objects (Amazon S3) are encrypted too.
• Sign-in links are stored only as a hash, so a copy of the database cannot be used to sign in.

Backups and recovery

• The database is backed up automatically every day, with point-in-time recovery to any moment in the last 7 days.
• Uploaded files are backed up daily, and each backup is kept for 35 days.

We do not publish a recovery time or recovery point objective. If your assessment needs one, ask us and we will explain how a restore would work for your procurement.

Signing in and access control

• There are no passwords. Signing in uses a single-use link sent to your email address, or Sign in with Google.
• A sign-in link lasts 15 minutes, works once, and is stored only as a hash.
• Two-step sign-in adds a code from an authenticator app on your phone, such as Google Authenticator or Microsoft Authenticator, after the link or Google. Set it up by scanning a QR code or by typing a setup key. It is on by default for new accounts and can be turned on or off in Settings. Codes work once, and ten recovery codes cover a lost phone.
• Sessions last up to 8 hours, and signing out ends the session immediately.
• "Sign out other devices" ends every other session on the account at once.
• A mobile number can be verified with a texted code. It is optional.
• Vederca staff sign in through a separate administrator entrance. Administrator accounts cannot sign in through the public sign-in page, and customer accounts cannot reach the administrator console.

Who can see what

• Each organisation's data is separated. Procurement teams see their own procurements; vendors see their own responses.
• Roles decide what a member of your team can see and change.
• Vendors never see each other's submissions, pricing or scores.
• Vederca staff access is limited to platform administrators, and their actions are recorded in an audit log.

Confidentiality

• Everyone accepts the Platform Confidentiality Undertaking before they see procurement material.
• A procurement can be invite only, so it is never listed anywhere.
• A procurement team can run a procurement anonymously: vendors see the sector and size, not the name.
• Where a procurement requires an NDA, a vendor reaches the material only once the procurement team approves it.

Artificial intelligence

Documents and responses are analysed by our AI provider, listed in the table below. That processing can take place outside Australia, in the United States, which the Privacy Policy describes as an overseas disclosure. The provider does not train its models on data sent through its commercial API. Every AI output is decision support: a person on your team makes the decision.

Deleting data

• Anyone can delete their own account from account settings. Their personal details are removed straight away, every session ends and the account cannot be restored. Procurement records they took part in stay complete and show "Deleted user" where they appeared.
• When an organisation's last member deletes their account, the organisation is closed. You can then ask us to erase it: its members, profile, documents and files, and a procurement team's own procurements with their documents and AI analysis, are deleted. Its responses to other organisations' procurements stay in those procurements, because those records belong to the procurement team.
• Copies of deleted data in backups are not edited; they expire on the schedule above.

The Privacy Policy sets out how long each kind of record is kept.

Incidents and breach notification

If an incident affects your information, we will assess it promptly and respond in line with the Notifiable Data Breaches scheme under the Privacy Act. Where a breach is likely to result in serious harm, we will notify affected customers and individuals and the Office of the Australian Information Commissioner, as the law requires.

Supporting your CPS 234 and CPS 230 obligations

Vederca is not regulated by APRA and holds no security certification. If your institution is APRA-regulated, using Vederca may fall within your own obligations under CPS 234 (Information Security) and CPS 230 (Operational Risk Management), including how you manage service providers. We support that assessment rather than replace it:

• this page and the subprocessor table describe the controls and providers that handle your information;
• we notify you of incidents affecting your information, as set out above;
• we answer security questionnaires and due diligence requests: email us at the address below;
• a procurement's documents and report can be downloaded, so the record stays in your hands.

We do not currently hold ISO 27001 or SOC 2 certification, and we have not published the results of an independent penetration test.

Subprocessors

Reporting a vulnerability

Email support@vederca.com with "Security" in the subject line, and include enough detail to reproduce the issue. We aim to acknowledge reports within two business days and will tell you when the issue is resolved.

While you are testing, please do not access other people's data, degrade the service for anyone else, or publish the issue before it is fixed. The same address is listed in /.well-known/security.txt.

Related

• Privacy Policy: what is collected, who receives it and how long it is kept.
• Terms of Service: the agreement covering use of the platform.
• Contact: anything else.