Security

Supply Chain Manager runs on Vercel, which serves the application over its global edge network and runs our server-side compute. Our primary database — the source of truth for products, inventory, suppliers, purchase orders, and transaction history — is a PostgreSQL instance hosted on Neon. Authentication and account/session management is handled by Clerk. We don't operate our own physical servers; all three providers are established infrastructure vendors we rely on rather than build ourselves.

All traffic to and from the application is served over HTTPS — Vercel automatically redirects any HTTP request to HTTPS and supports TLS 1.2 and 1.3. Connections to our Neon database also require TLS/SSL; Neon does not accept unencrypted connections.

Our database provider, Neon, encrypts customer data at rest using AES-256 encryption on the underlying storage.

Each organization's data is logically isolated from other organizations in the database. Access to the production database and infrastructure is limited to the people who operate and support the Service, authenticated through our infrastructure providers' own account controls rather than shared credentials. We do not sell or share your operational data with third parties.

You can request export or deletion of your organization's data at any time by emailing hello@supplychainmanager.io. We'll confirm the request and let you know once it's complete.

The public live demo (?demo=true) runs against a seeded sample dataset shared by every visitor. Writes made in demo mode (orders, adjustments, imports) are intercepted as simulations and never persisted — the canonical demo dataset stays unchanged for the next visitor. No personal or customer data is used in the demo environment.

We currently use the following subprocessors to provide the Service:

• Vercel — application hosting and compute
• Neon — database hosting
• Clerk — authentication and account management

If you believe you've found a security vulnerability, please email hello@supplychainmanager.io with details. We ask that you give us a reasonable opportunity to investigate and address the issue before any public disclosure.