What we hold and who can reach it.
You can reach only the communities you hold a seat on. We check it on every request.
- Encrypted in transit and at rest
- Checked on every request
6 controls that run on every request
Every request runs the same checks, from the browser to the payout.
1. Encryption
Everything travels to us over TLS 1.3 and is stored encrypted with AES-256 by our hosting and database providers.
2. Who sees what
A community manager reaches their own communities and nobody else’s, and a vendor reaches the work orders its own company was awarded. The limit travels with the account, so it holds on every screen and every export.
3. Approvals and payouts
Only the platform can approve a work order or release a payout. A request from a browser cannot approve its own payment. Every payment leaves a record your board can open. Roles, verification decisions and insurance status are written to an audit log the database itself refuses to edit or delete.
4. Where it runs
The site runs on Vercel and your records sit in a Supabase database on Amazon’s cloud servers (AWS) — the same infrastructure companies of every size run on.
5. Signing in
Sign in with a password, or with a one-time link emailed to you. Either way the session belongs to your account and expires on its own, and signing out ends it there and then.
6. Certificates
The insurance certificate for a vendor working at your community opens from your dashboard, with the date it runs out on it. From the day after one lapses, that vendor cannot propose on new work until a current certificate is verified.
What does verification prove?
That the document exists, that a person read it, and that it has not expired. Quality of work is your board’s call.
Every company files these documents before it can propose, and a person at VendoRFP reads each one and records what it says along with the date it runs out.
See every document and the day it lapses →- Business registrationWe verify the business registration and the W-9 before a vendor can open an RFP at all. The registration tells a community which company it would be signing with.
- W-9The W-9 is the form the community and its management company file their 1099 from at the end of the year.
A person at VendoRFP opens the certificate and takes the limits and the expiration date straight off the document. Where that disagrees with what the vendor typed, the certificate wins. From there the vendors propose, and your management team picks the one it wants.
Read a certificate yourself →Found something? Tell us.
If you discover a security vulnerability, report it below. We read and acknowledge every report.
Bring your community onto VendoRFP.
Free for one community. Each seat sees only what you give it.