You are about to put your supplier paperwork and your budget in someone else's software. Here is exactly how it is looked after, with no vague talk about bank-grade anything.
Every customer has its own tenant, and application queries are scoped to it. There is no screen in Spendvora where one customer's records can appear inside another's.
Passwords are hashed with Argon2id, the current recommended algorithm. We cannot recover one, only help you reset it.
Your OpenAI API key and your Xero OAuth tokens are encrypted before they are written to the database, using a key held outside the codebase.
Uploads sit on the application server only while the queue reads them, then move to a private bucket that is not publicly readable.
Opening an original document generates a signed link that dies within minutes. There is no permanent public URL to a file.
Every action that changes data carries a CSRF token, and sign-in cookies are HTTP-only and marked secure over HTTPS.
Every action is gated on a named permission, and record visibility is enforced per user, not just hidden from the menu.
Meaningful changes are recorded with the user, the record, the time and the IP address, and owners and managers can read the log.
The activity log is not an add-on. It is how you answer "who approved that" six months later.
Worth being specific, because "the cloud" is not an answer. When you upload a file it is written to a directory above the web root, so it can never be fetched directly by URL. The scan worker picks it up, sends the contents to the OpenAI API for extraction, and writes the results back into your tenant.
Once processing is done the file is archived into a private storage bucket in Ireland and removed from local disk. Viewing it later goes through Spendvora, which checks your permissions and then issues a short-lived signed link.
The one place your data leaves the UK and Ireland by default is AI extraction, which runs in the United States with OpenAI. If you would rather that ran under your own commercial arrangement, add your own OpenAI key in Settings. The full list of who processes what is on the sub-processors page.
We would rather be trusted than certified-sounding. So, plainly: Spendvora does not currently hold ISO 27001 or SOC 2, and there is no service level agreement attached to the standard terms. We are a small British company, and we are not going to pretend to be an enterprise compliance operation.
What we will do is answer specific questions honestly. If your procurement team needs a security questionnaire filled in, a named hosting provider, or a data processing agreement signed, email procurement@brainwavedesigns.co.uk and you will get a straight response from someone who knows the code.
Most real incidents are not clever attacks. They are shared logins and people who left months ago.
Never share an account. The audit trail is only worth having if a name means one human being.
Buyers do not need approval rights. Viewers do not need edit rights. Use the roles and the per-user visibility settings.
Disabling a user in Settings takes seconds and immediately ends their access.
Documents go through AI extraction. There is rarely any reason to put sensitive personal data into a purchase record.
Found a security problem? Tell us at procurement@brainwavedesigns.co.uk before telling anyone else, and see section 6 of the acceptable use policy.
Ask them. You will get an answer from the people who built it, not a sales script.
Get in touch