Workspace data is access-controlled with row-level security, encrypted in transit and at rest, and hosted in Zurich (Switzerland). Vrocure does not use your content to train AI models.
Orders, drawings, bids, and invoices belong to a workspace. Access is checked against your workspace membership and role, using row-level security in the database.
Vrocure is operated by RZ Global Solutions, a UK-registered company and an ICO-registered data controller. The public Security page and the Privacy Policy are the long-form versions of this answer.
Hosted in Zurich (Switzerland) on Supabase. Encryption in transit (TLS) and at rest.
Drawings sit in private storage. Access links are signed and expire.
Card payments are handled by Stripe. Card numbers are not stored on Vrocure servers.
Portal analytics do not record the screen. Procurement data is not replayed in session recordings.
Passkeys and authenticator-app MFA are available to any signed-in user under Settings → Account Security. A workspace can require MFA for owner and admin members and for people with finance permission. See Do you support MFA / passkeys?.
Manufacturers in a competitive bid see a sanitised drawing and a ghost name, not your client’s identity or internal part name. AI redaction is there to strip company names, logos, and reference numbers before release. That is a product rule, not an optional toggle you must remember.
Dr. Review and Vro analyse a file to answer you. Customer drawings, prices, and supplier history are not used to train public models.
Privacy requests — access, correction, deletion — go through the Privacy Policy. A data processing agreement and sub-processor list are available for customers who need them in a security review. Email support@vrocure.com and say it is a privacy request.
For a security questionnaire, start from Security. For a suspected exposure, email support@vrocure.com with the workspace name and what you observed. Do not send drawings or passwords in the first email.