Security and data protection
Procurement data — prices, suppliers, decisions — is sensitive. This page explains how we protect it. We only describe what actually works in Verdika.
Data in the European Union
Verdika runs on a server in the European Union. The AI provider is European, and your data is not used to train its models.
Encrypted connection
All connections to Verdika use HTTPS (TLS) only. Browsers are told never to connect unencrypted (HSTS), and pages cannot be embedded in other websites.
Secure sign-in
Passwords are not stored — only their cryptographic hash (bcrypt). After several failed attempts sign-in is temporarily locked. Two-factor authentication (2FA) with a code from a phone app can be enabled. When a password is changed, sessions on other devices end.
Company data isolated
Each company’s data is isolated from others. Automated tests run before every update check that a user of one company cannot access another company’s data.
Permissions and activity log
Every user has a role and permissions. Important actions (choosing a winner, changes, deletions, permission changes) are logged: you can see who did what and when.
Suppliers — no registration
A supplier replies via a personal link for their invitation. They do not need an account and cannot see other suppliers’ offers.
Server protection
The server can only be accessed with a cryptographic key (no passwords), the firewall allows only necessary connections, security updates are installed automatically and password guessing is blocked. The database is not directly reachable from the internet.
Backups
Backups of the database and uploaded files are made automatically every day.
Your data is yours
A company can download all its data and delete its account at any time. How we process personal data is described in the Privacy Policy and the Data Processing Agreement.
Found a vulnerability?
If you notice a security issue, please write to info@verdika.lt — we will respond and fix it. Please do not disclose it publicly until it is fixed.