Workspace access
Sessions use HttpOnly cookies, password hashing uses Argon2id, and authenticated changes require CSRF validation. Workspace records are scoped to their organization. Member access can be disabled, with existing sessions invalidated.
Security, explained
Security for your vendor workspace
Security starts with how people access the workspace and how documents are handled. Here is what the implementation supports and what must be configured for a hosted deployment.
Account protection
Email verification, password recovery, authenticator-based MFA and single-use recovery codes are available. Enterprise OpenID Connect sign-in requires an administrator-configured identity provider and organization mapping.
Document handling
Uploads are bounded to 10 MB and validated by file type. Production configuration requires private S3-compatible storage and malware scanning. Signed download links are short-lived. These controls require a correctly configured deployment.
Controlled sharing
Vendor submission links are scoped, expiring and revocable. Integration tokens are hashed, revocable and scoped. Reusable connection credentials are encrypted. Outbound webhook destinations require operator approval.
Review and accountability
Audit events record key changes and review decisions. Compliance rules evaluate configured evidence requirements; the product does not independently certify insurance or legal compliance.
Operational assurance
Backup restoration, monitoring, incident handling, retention policies and provider connections must be validated for the operating environment. Jame Systems does not claim SOC 2 or ISO certification.