Security

Overview

SupplyGenius is built on Google Cloud Platform(opens in new tab) and designed around encryption in transit and at rest, strict network and database access controls, and infrastructure managed as code with peer-reviewed changes. This page summarizes our current security practices. If you need more detail for a vendor risk review or security questionnaire, contact us at admin@supplygenius.ai.

Compliance & Certifications

Our infrastructure and processes are built around controls commonly required for SOC 2, including access logging, encryption, change management, and network security, as we work toward formal SOC 2 Type I certification. We have not yet completed a third-party compliance audit. If your organization requires a specific certification or a completed vendor security questionnaire as part of a procurement process, contact us at admin@supplygenius.ai and we'll work with you directly.

Google Cloud Platform, our infrastructure provider, separately maintains its own ISO/IEC 27001, SOC 1/2/3, and PCI DSS certifications for the infrastructure our platform runs on. Current certificates and audit reports are available through Google's Compliance Reports Manager(opens in new tab).

Infrastructure & Hosting

• Hosted entirely on Google Cloud Platform(opens in new tab) (GCP), running on managed, serverless compute (Cloud Run) rather than self-managed servers.
• Our production database has no public IP address and is reachable only over Google's private network.
• Overly permissive default network rules are disabled, and network traffic is logged.
• There is no public SSH access to any server. Administrative access to infrastructure is brokered through Google Identity-Aware Proxy and tied to individually authorized accounts.

Encryption

• All data in transit is encrypted using TLS/HTTPS.
• Data at rest, including our database and uploaded documents, is encrypted using Google Cloud's storage-level encryption(opens in new tab), enabled by default on our Cloud SQL database.
• Application secrets and API credentials are stored in Google Secret Manager and are never committed to source control.
• Third-party OAuth credentials (for example, tokens used to connect integrations like Procore) are additionally encrypted at the application layer before being stored.

Authentication & Access Control

• User authentication is handled by Firebase Authentication. Sessions use HttpOnly, Secure cookies that are not accessible to client-side scripts, reducing exposure to cross-site scripting (XSS) attacks.
• Access within the platform is role-based (member, organization admin, and internal super-admin roles), and organization data is additionally isolated using row-level security policies enforced at the database layer, independent of application code.
• Suspending a user account immediately revokes that user's active sessions.
• Database access uses Google Cloud IAM-based authentication rather than static, shared passwords.
• Changes to who can access production infrastructure are made through code and go through pull request review, so every access change has an audit trail.

Data Storage & Backups

• Our production database runs on Google Cloud SQL for PostgreSQL in a regional (multi-zone) configuration, with automated daily backups, point-in-time recovery, and 7 days of retained backups and transaction logs.
• Uploaded documents (such as baseline specifications and vendor bids) are stored in access-controlled Google Cloud Storage buckets that are not publicly accessible, with object versioning enabled.
• You may request access to, or deletion of, your account data and uploaded documents at any time. See our Privacy Policy.

Monitoring & Change Management

• Google Cloud audit logging tracks administrative activity and data access across our infrastructure, retained for up to 400 days. Automated alerts notify our team on IAM policy changes, service account creation or deletion, secret access, storage bucket deletion, and authorization failures.
• We maintain an internal incident response procedure covering detection, containment, and notification.
• All infrastructure is defined and version-controlled as code (Terraform). Infrastructure changes go through pull request review before being applied.
• Application changes go through automated testing and linting before merge. Production deployments require a tagged release and a separate manual approval step, distinct from our staging environment.

Payments

We do not store payment card data on our own systems. Billing and payment processing are handled by Stripe, a PCI DSS Level 1 certified payment processor.

Subprocessors

We use a limited set of third-party service providers to operate the platform:

¹ Zoho hosts data in the United States, EU, India, China, and Australia, and assigns each account to the nearest available region by IP address at signup.

² We use the Gemini API on Google's paid tier, which states that Google does not use submitted prompts, documents, or responses to train or improve its models.