Security
Built to pass a procurement security review.
Kelqio sits in the path of supplier pricing and order data. That places it inside the scope of your security, data protection and continuity requirements — so we document it rather than reassure you about it.
Security requirements reviewed for each project
01Controls
What is in place by design.
Role-based access control
Buyers, approvers, administrators and supplier users are separated, with permissions granted by role rather than by exception.
Tenant and relationship isolation
A supplier sees the customers they are connected to, and a customer sees the suppliers connected to them. Neither sees the rest.
Encryption in transit and at rest
Applied to catalog, pricing and order data throughout the platform.
Documented data model
What is stored, why it is stored, and how long it is retained — written down and available for review.
Audit trail
Catalog changes, order events and approval decisions are recorded so a decision can be reconstructed rather than inferred.
Least-privilege supplier access
Supplier users act only on their own products, catalogs and orders for the customers they are connected to.
02Data path
Where supplier data goes, and what applies to it at each step.
A security review is easier when the data path is drawn first. Each step below is a place data rests or moves, and the control that applies there.
- 01Supplier
Data is submitted
Catalog, pricing and availability data leaves the supplier, by file, API or the supplier workspace.
What is happening to the data
Commercial data — prices and conditions a competitor would like to see.
The control that applies
Encryption in transit, and supplier users acting only for their own supplier.
- 02Kelqio
Data is stored
It is held against a supplier, and against the specific customer relationships it belongs to.
What is happening to the data
Multi-supplier and multi-customer data sitting in one platform.
The control that applies
Tenant and relationship isolation, plus encryption at rest, on a documented data model.
- 03◇ DecisionKelqio
Data is accessed
Buyers, approvers, administrators and supplier users all read a different subset of it.
What is happening to the data
The interesting failure is not an intruder — it is one party seeing another’s conditions.
The control that applies
Role-based access control, granted by role rather than by exception.
↳ Not entitled · Supplier
The data is not returned
Access is refused by role, and the attempt is written to the same trail as the successful ones.
- 04Your stack
Data is delivered
Catalogs, carts and orders are exchanged with your ERP and procurement platform.
What is happening to the data
The data crosses back into your environment and your own controls.
The control that applies
Connections are scoped: a connection for catalog only carries catalog only.
- 05Kelqio
Actions are recorded
Catalog changes, approval decisions and order events are written down as they happen.
What is happening to the data
The record is what makes a past decision reconstructable rather than inferred.
The control that applies
Audit trail and documented retention — what is kept, why, and for how long.
03Security review
The topics to cover with your IT team.
Use these topics to structure your security review and define the evidence required for your project.
Certifications
Formal certification status and audit reports. We will publish the specific standard and date once held.
Hosting and data residency
Hosting regions, subprocessors and residency options.
Availability commitments
Service level commitments, maintenance windows and continuity plan.
Penetration testing
Testing cadence and the summary shared under NDA.
Backup and recovery objectives
Recovery point and recovery time objectives.
Data processing agreement
Standard DPA terms and subprocessor list.
04How to evaluate us
What to ask for in a security review.
Ask for the data model first. A platform that cannot describe precisely which fields it stores, for whom, and for how long, will not be able to answer the harder questions either.
Then ask about isolation between commercial relationships. In a multi-supplier, multi-customer platform, the interesting failure is not an outsider getting in — it is one supplier seeing another supplier’s pricing, or one customer seeing another customer’s conditions.
Finally, define the evidence, responsibilities and service commitments required for your deployment.
Next step
Bring your supplier list. We’ll show you the flow.
A working session with our team, using your systems and your supplier mix — not a generic slide deck.
- 01
Where your suppliers sit today: connected, semi-connected, or not at all
- 02
How each channel would route through Kelqio into your ERP and procurement platform
- 03
What connecting the next twenty suppliers would actually involve
Enterprise integration product. No credit card, no self-serve trial — a conversation with someone who knows procurement systems.