How your supplier data is kept

Hosting and encryption

Where it runs

On OVHcloud servers in Virginia, United States: the application, its Postgres database and the supplier documents. Cloudflare sits in front for DNS, TLS and request filtering, and the origin only accepts traffic from it.

In transit

TLS everywhere, with HSTS. Webhooks go only to public HTTPS addresses and are signed with a secret only you hold.

At rest

Supplier documents (certificates, SPRS records, insurance, W-9s), webhook signing secrets and Slack or Teams webhook URLs are encrypted by the application with AES-256-GCM, a fresh random IV per value, under a key kept outside the database. Lists, findings and the audit log are stored in the database on the same servers without that extra application-level layer.

API keys

Shown once when made and stored only as a SHA-256 hash. A key can be read-only.

Error reports

Sentry, only when enabled, with no request bodies, headers, cookies or query values.

Who can do what

Roles

Owner, reviewer and viewer on each account. Every API route states the least role it needs; viewers and read-only keys can only read.

Two-person rule

When an owner turns it on, a reviewer's confirmation of a possible exclusion or screening match waits for a second, different reviewer, and so does closing a case as an exception or accepted risk. Onboarding approvals never let the requester approve their own request.

Your email domain

An owner can claim the company's email domain, so colleagues who sign in with a verified address there join with a set role. The claim needs the owner's own address at that domain to be verified by the sign-in provider, and public webmail domains can't be claimed.

Single sign-on

A claimed domain can be tied to an enterprise SSO connector on the shared Programmable sign-in, so people from that domain go straight to your identity provider.

Sending limits

Mail an account sends to addresses it chooses (document requests, supplier portal links, invites) is capped per hour, per day and per recipient, and one address can't be sent more than 20 such emails a day across every account. A watch emails an outside address only after it accepts, and every alert carries a one-click unsubscribe.

A record you can stand behind

Hash-chained log

Every action is written to the account's audit log and sealed into a SHA-256 hash chain. The database refuses any change to a sealed entry, and changing one would break every hash after it.

Anchors

The chain's head is anchored daily (sent by webhook when you have one) and printed in every evidence package, so a rewritten log shows up against an anchor you already hold. The chain can be verified from the dashboard or the API.

Dated evidence

What each source said at each check is kept with its data date and a SHA-256, so an export cites the record as it stood, and any supplier can be shown as it stood on a past date.

See it for yourself: a sample evidence package (PDF, fictional supplier) with its attached data, SHA-256 and audit chain head.

No AI model in screening

Matching is a confidence score from the name, state, city and website, with its reasons shown, and only a person or an exact UEI or CAGE you supplied confirms a match. Findings come from fixed rules over the public records; a name-only exclusion or screening match is always "possible, confirm". The sentence box is read with plain rules and registry lookups. Watch calls no AI provider unless your organization turns on AI help in the chat, and then it sends only the typed request, never supplier records. Text in uploaded PDFs and photos is read on our own server.

Backups

Nightly

The database and the documents volume are dumped every night into one archive, encrypted with AES-256 under a key kept apart from the backups, and kept 14 days on the server.

Off-site

Each archive is copied to Backblaze B2 object storage, which sees only the encrypted file, and kept 30 days. A backup that fails, or has no off-site copy, alerts us.

Restore drill

On the first Monday of every month the newest archive is checked against its off-site copy, restored into a scratch database and its row counts compared with what the backup recorded. A failed drill alerts us.

What is stored, and what isn't

What Watch keeps

Your account and team; your supplier lists (names, identifiers, locations, contacts you add); matches and who confirmed them; the public-record answers behind each check; findings, decisions, cases and notes; documents suppliers or your team upload; the audit log; and a 90-day log of the email sent.

What it never loads

Records about individuals from exclusion lists, court records (PACER), credit reports or consumer data. Business entities only.

How long

As long as you keep the account. Superseded evidence and old check records go after ten years; findings and the audit log stay with the account. Deleting a list deletes everything in it; deleting the account deletes everything within 30 days, apart from invoices and what the law requires us to keep.

Who else sees it

Only the subprocessors that run the service, each listed with what it can see. Your data is never pooled across customers, sold, or used to train AI.

The public check

The "check one supplier" box on this site stores nothing but rate-limit counters; answers are held in memory for an hour so repeats don't call the registry again.

The full list of third parties and what each can see: subprocessors. Also the privacy policy, the data processing addendum and where the data comes from.