SECURITY UPDATED AUGUST 2026

Your bids are your business.
We treat them that way.

Ok2Source handles RFQs, supplier correspondence, and bid documents — commercially sensitive by definition.

Pentest passed, July 2026

Tested by an independent third party. Report available on request.

Runs on Google Cloud

ISO 27001 and SOC 1/2/3 certified infrastructure.

Stored in the United States

All customer data lives in US data centers.

Never used to train AI

Not by us, not by anyone else — and our AI provider retains none of your data.

CONTROLS SEC-01 — SEC-08

01 Encryption Everything is encrypted: AES-256 at rest, TLS 1.2+ in transit. Email credentials get an additional layer of encryption on top.

02 Private to your company Each company on Ok2Source has its own private space — nobody at another company can see your RFQs, suppliers, or bids. The wall is built into the database itself.

03 Access control Sign-in is handled by WorkOS (SOC 2 Type II) — we never store passwords, and multi-factor authentication is available. Role-based permissions gate every action, and nothing gets a public link: documents are only served to signed-in, authorized users.

04 Infrastructure Runs on Google Cloud, with production fully separated from development. Continuous backups allow point-in-time recovery.

05 Audit trail Every change to your data is recorded — who, what, when, with before-and-after values — in a log the application itself cannot read, change, or delete.

06 Secure development Every code change passes secret scanning, static analysis, and dependency vulnerability checks before it ships.

07 Incident response If your data is ever caught up in a security incident, we tell you within 72 hours of confirming it — what happened, what was affected, and what we are doing about it.

08 Deletion on request Close your account and we delete your data within 30 days, apart from the narrow set of records we are legally required to keep.

SUBPROCESSORS 05 VENDORS

Every vendor that touches customer data, and what happens to it there.

Amazon Web Services Backup AI processing (Bedrock, United States) when our primary AI provider is unavailable. Zero data retention — prompts and outputs are never stored. ISO 27001 and SOC 2/3 certified.

Google Cloud All hosting, storage, and primary AI processing. ISO 27001 and SOC 2/3 certified. Encrypted at rest.

PostHog Product analytics, session replay, and error tracking, in the app and the supplier portal. Usage events, session recordings, and error reports tied to user id and email — plus your organization in the app. Form inputs are masked; email content and quote documents are excluded. Recordings expire automatically; profiles and their events are deleted at account close. Stored in the United States. SOC 2 Type II certified.

WorkOS Sign-in. Holds your name, email, and sign-in history only. Deleted when your account closes. SOC 2 Type II certified.

DOCUMENTATION

Want the details?

The full security overview, the penetration-test report, and architecture walkthroughs are available on request — you’ll get them from a founder, not a portal.