Trust & safety
How VendorSteward keeps your data secure
Your vendor directory holds the contracts, costs, and contacts your credit union depends on. Here's exactly how that information is protected — written for the teams who'll ask.
01Tenant isolation — your data is yours alone
VendorSteward is multi-tenant, and every record — vendors, contracts, team members, audit history — is tagged to your institution and enforced by row-level security at the database layer. This isn't a UI-level filter: the database itself rejects any request for a record that doesn't belong to your institution, no matter where the request comes from. One credit union can never read, modify, or delete another institution's data.
02Private, access-controlled contract storage
Uploaded contract PDFs are stored in private storage — never public links. A contract can only be opened through a short-lived signed URL (valid for 10 minutes) that is issued only after the database confirms the requesting user belongs to the institution that owns the vendor. The URL expires automatically; there is no permanent, shareable link to your contracts.
03Payments handled entirely by Stripe
VendorSteward never sees, stores, or transmits your card details. Checkout and subscription management run on Stripe's hosted, PCI-compliant pages. Payment status updates reach us only through webhook notifications that are cryptographically verified with a signing secret — unverified requests are rejected outright. Return redirects are validated against an exact allowlist of our own domains to prevent open-redirect attacks.
04Authentication & account security
Login is managed by a dedicated authentication platform, not custom code: email/password with one-time passcode verification, Google sign-in, and verified-link password resets. Passwords are never stored in our systems, and session tokens are issued and rotated by the auth provider. Team access is role-based — billing and institution administration are restricted to admins, and members see their own institution's data only.
05Input safety
All user-supplied links (contract references, vendor websites) are validated to allow only standard secure web protocols, preventing script injection and malicious link payloads. Search and form inputs are treated as data, never executable content.
06Change history you can audit
Every change to a vendor's renewal date or status is written to an immutable audit log with the team member who made it, the old and new values, and a timestamp — so you always know who decided what, and when.
07Data continuity
A lapsed or cancelled subscription never deletes your vendor data — it's locked, not erased, and restored the moment you reactivate.
08Transport & infrastructure
All traffic travels over HTTPS. VendorSteward runs on a managed cloud platform that handles infrastructure hardening, updates, and monitoring, so security patches are applied platform-wide without customer action.