Trust and security. Your company's prices, suppliers and orders stay yours.
Procumi holds the quotes you receive, the prices you negotiate and the orders you place. This page explains where the app runs, how we protect that data, who can see it and what happens to it when you leave. We don't claim anything we don't do.
Hosted on Railway. The app and its database run in the European region, in Amsterdam.
Procumi runs on Railway, a cloud hosting platform with a SOC 2 Type II audit and a SOC 3 report. The application server, the PostgreSQL database and uploaded documents are in Railway's EU West region, in the Netherlands. Railway Corporation is based in the USA; data transfers are covered by its data processing agreement.
- Railway's certifications, in their Trust Center
- Regular database backups
- App and website status, public on our status page
Protected in transit and at sign-in. Encrypted connections, unreadable passwords, sessions that expire.
Everything between your browser and Procumi is encrypted over HTTPS. Passwords are never stored: the database keeps only a scrypt hash, with the parameters OWASP recommends, from which the password cannot be recovered.
- Sessions last 30 days, in a cookie that web pages cannot read
- Failed sign-in attempts are rate-limited, per account and per IP address
- Email signatures pasted from Outlook are stripped of code before they are saved
Everyone sees only what they need. Data is separated by company, and within a company, by role.
Each company's data is kept apart from every other company's: no one outside your account can see it. Inside the account, everyone has a role. Buyers create RFQs and orders, approvers decide orders above the threshold, admins manage the team and company details. Site accounts send requisitions and log deliveries without seeing any price.
- A supplier sees only the RFQ sent to them, through a unique link, with no account
- Prices read automatically from PDFs and photos enter the comparison only after you confirm them
- Documents sent for automatic reading are not used to train AI models
GDPR, in writing. You know who processes your data, where, and for how long we keep it.
For the data in your account, Procumi acts as a processor under our Terms. The companies that help us provide the service are listed publicly on Sub-processors, and the details are in our Privacy Policy.
- We email you at least 15 days before engaging any new sub-processor
- When the contract ends, data is deleted within 30 days and backups within a further 30
- A security incident is notified to the authority within 72 hours, and to you without undue delay