Records and access
What we hold, and who can reach it.
Your session reaches only the communities you hold a seat on, checked on every request.
Every request
How your data is protected
Every request runs the same checks, from the browser to the payout.
The controls
6 controls that run on every request
Encryption
Everything travels to us over TLS 1.3 and is stored encrypted with AES-256 by our hosting and database providers.
Who sees what
A community manager reaches their own communities and nobody else’s, and a vendor reaches the work orders its own company was awarded. The limit travels with the account, so it holds on every screen and every export.
Approvals and payouts
Approving a work order and releasing a payout both happen on our servers, where the rules live — nothing a browser sends can approve its own payment. Every payment leaves a record your board can open. Roles, verification decisions and insurance status are written to an audit log the database itself refuses to edit or delete.
Where it runs
The site runs on Vercel and your records sit in a Supabase database on Amazon’s cloud servers (AWS) — the same infrastructure companies of every size run on, managed by them rather than on a server we keep ourselves.
Signing in
Sign in with a password, or with a one-time link emailed to you. Either way the session belongs to your account and expires on its own, and signing out ends it there and then.
Certificates
The insurance certificate for a vendor working at your community opens from your dashboard, with the date it runs out on it. From the day after one lapses, that vendor cannot propose on new work until a current certificate is verified.
Verification
What does verification prove?
That the document exists, that we read it, and that the date on it has not passed. How well a vendor mows a lawn is your board’s judgment, made from the proposals and the visit records.
What closes a proposal
Every company files these documents before it can propose, and a person at VendoRFP reads each one and records what it says along with the date it runs out.
See every document and the day it lapsesAlso on file
- Business registrationWe verify the business registration and the W-9 before a vendor can open an RFP at all. The registration tells a community which company it would be signing with.
- W-9The W-9 is the form the community and its management company file their 1099 from at the end of the year.
A person at VendoRFP opens the certificate and takes the limits and the expiration date straight off the document. Where that disagrees with what the vendor typed, the certificate wins. From there the vendors propose, and your management team picks the one it wants.
Read a certificate yourselfResponsible disclosure
Found something? Tell us.
If you discover a security vulnerability, report it below. Every report is read by a person and acknowledged.