Security

Hosting and infrastructure

• The application runs on Vercel, with server functions in Singapore.
• Workspace data and uploaded files are stored in Supabase (PostgreSQL database and file storage) on Amazon Web Services in Singapore.
• Invoices and delivery slips are read by a dedicated document-processing worker hosted on Railway.
• Application errors are reported to Sentry so that we can find and fix problems quickly.

See every provider that processes customer data on our Subprocessors page.

Encryption

• All connections to MaterialPro use TLS (HTTPS). HTTP Strict Transport Security (HSTS) tells browsers to connect over HTTPS only.
• Data at rest in the database and file storage is encrypted with AES-256 by Supabase on Amazon Web Services.

Workspace isolation

• Each workspace's records are separated in the database by PostgreSQL row-level security, so a signed-in user can only read rows that belong to their own workspaces.
• Every API request also checks the user's active workspace membership and role permissions before it reads or changes data.

Sign-in and access control

• Members sign in with a one-time code sent to their email address. Code requests are rate-limited to slow down guessing and abuse.
• Members can turn on two-factor authentication with an authenticator app (TOTP), and workspace owners can require it for everyone in the workspace.
• An admin can reset a member's two-factor authentication. The reset signs that member out of every session and is recorded in the activity log.
• Role-based permissions control what each member can see and do. Owners and admins set up roles to match how the team works.
• Deactivating or removing a member ends their access to the workspace immediately.

Audit trail

• On the Business plan, the audit log records each change to your records: who made it, when, and the values before and after. Admins can filter the log and export it as CSV.

Payments

• Card details are entered on pages hosted by Stripe, a PCI DSS Level 1 certified payment provider. MaterialPro never receives or stores full card numbers.

AI features

• When you use an AI feature, such as reading an invoice or a delivery slip, the relevant document and context are sent through OpenRouter to the AI model that does the task. Check AI output before you approve orders, invoices or payments. Section 3.1 of our Privacy Policy explains this in more detail.

Your data when you leave

• Most screens, including purchase orders, invoices, vendors and receipts, let you export your records as CSV at any time.
• If you leave MaterialPro, we will prepare a full export of your workspace, including attached files, on request. Email support@materialpro.io to arrange it.
• The workspace owner can delete the workspace from its settings. Deletion permanently erases the workspace's data from our active systems; copies in our providers' backups expire on their backup schedules.

Certifications

• MaterialPro does not hold a SOC 2 or ISO 27001 certification today. We are glad to complete your security questionnaire and to describe any of the controls above in more detail.

Reporting a vulnerability

If you believe you have found a security vulnerability in MaterialPro, email us the details and the steps to reproduce it. Please do not access or change other customers' data, and give us reasonable time to fix the issue before you disclose it. We will acknowledge your report and keep you informed.

Security contact: support@materialpro.io

Related documents

• Privacy Policy
• Subprocessors
• Terms of Service