Role-based access
Hiring managers, procurement, and finance see the queues they own. Approvals cannot skip the chain you configure.
Trust center
Security that finance can defend
Procurement data is approval history, rates, and invoices. Every action has an owner. Suppliers never need a standing portal password to respond to a single event. Send your questionnaire with the demo - we answer with facts, not badges we have not earned.
Encryption
TLS in transit. Encryption at rest. We walk your IT team through the current stack on the security review.
Audit trail
Requisition, award, timesheet, and invoice events keep a complete trail. Month-end is a report, not a reconstruction.
Link-based supplier access
Suppliers receive a secure link for RFx, PO acknowledgement, timesheets, or invoices. No extra account to provision or forget.
Compliance documents
KYC and certificate expiry sit on the supplier record with alerts, so compliance is not a shared inbox.
ERP boundary
REST API and connectors for SAP, Oracle, and Microsoft Dynamics. Credentials stay in your integration design.
Retention and recovery
Backup, retention, and disaster-recovery targets for a production tenant are confirmed on the security review. We do not publish a fake RPO or RTO.
Least privilege on the tenant
Roles are scoped to queues: request, source, deliver, pay. Finance can read the award trail without owning the event.
RFP and security questionnaire pack
Use this table in your RFP. Attach SIG, CAIQ, or your internal pack to the demo request, or send it to contact@aarohii.com with subject "Security questionnaire". We complete remaining items before or on the 30-minute call. We will not tick boxes we cannot defend.
| Question | Published answer |
|---|---|
| Product type | Cloud Vendor Management System. Source to settlement in one login. |
| Access control | Role-based: hiring managers, procurement, finance. Approvals cannot skip the configured chain. |
| Encryption | TLS in transit. Encryption at rest. Stack details on the security review. |
| Audit logging | Requisition, award, timesheet, and invoice events keep owner and timestamp. |
| Supplier access | Secure link for a single event (RFx, PO ack, timesheet, invoice). No standing portal password required for that event. |
| Data processed | Tenant data (suppliers, timesheets, invoices) to provide the product. Marketing site collects demo fields only - see Privacy. |
| Subprocessors / residency | Confirmed in writing for your production environment. We do not publish a fake global region map. |
| ERP | REST API and connectors for SAP, Oracle, Microsoft Dynamics. Credentials stay in your integration design. |
| SOC 2 / ISO 27001 | Not published. Status confirmed on request. No badge until the audit is complete. |
| Vulnerability reports | contact@aarohii.com, subject "Security". RFC 9116: /.well-known/security.txt |
| Architecture one-pager | Buyers and IT: web app (PWA) + REST API as ERP boundary. QA preview may be HTTP - do not load live personal data there. Production tenant URL is issued after demo on HTTPS. |
| Backup / DR | Retention, backup, and recovery targets are confirmed on the security review. We do not publish a fake RPO or RTO. |
Data handling
Customer tenant data (suppliers, timesheets, invoices) is processed to provide the product, not for this website's marketing list. Data residency and subprocessors for a production tenant are confirmed in writing for your environment - we do not publish a fake global region map.
This marketing site collects demo requests (name, work email, company, phone, team size, note). Details are in the privacy page.
Production vs preview
Tenant access is issued after the demo. Any public "working app" or Sign in link may be a QA preview over HTTP. Treat it as a product tour. Do not load live worker or supplier personal data until we confirm your tenant and HTTPS endpoint.
Incident and vulnerability reports
Write contact@aarohii.com with subject "Security". Include steps to reproduce. Do not attach live secrets or production exports. Machine-readable contact: /.well-known/security.txt (RFC 9116).
What we will not claim
We do not publish a fake star rating or a SOC 2 / ISO 27001 badge we have not completed. If your RFP requires those reports, say so on the demo. We will tell you the real status.
Next step
See it on your workflow
30 minutes. No credit card. Commercial terms after scoping.