Assurance Pack

Enterprise & Investor Assurance Pack

A plain due-diligence summary for security reviewers, procurement leads and investors. Every control carries its real status: Implemented, Pilot or Under Development.

Status as at 13 October 2026. Statuses match the Trust Centre.

Implemented

of 13 control areas

Pilot

of 13 control areas

Under Development

of 13 control areas

Key areas

How VEYRA protects buyers, suppliers and the decision record

Data isolation

Implemented

• Every buyer and supplier record belongs to one organisation.
• Database row level security limits reads and writes to members of that organisation and their role.
• Uploaded documents are stored in organisation-scoped paths.
• Buyer reporting returns totals only and never names suppliers.

Tamper-evident audit trail

Implemented

• Material changes are recorded by the database itself, so they cannot be skipped by going around the screens.
• Each entry carries a fingerprint of the entry before it; editing or deleting a past entry breaks the chain and the check shows where.
• Audit entries cannot be edited or deleted.
• Identity reveals, approvals and permission changes record their reason and authority.

Blind evaluation and approvals

Implemented

• Supplier identity stays hidden during the authorised blind stage.
• Award approval follows the organisation's spending limits and delegations.
• Countersignatures must be completed before an award is recorded.
• These controls reduce exposure to relationship bias; they do not eliminate it.

AI governance

Pilot

• AI may structure requirements, suggest matches and prepare recommendations.
• AI cannot approve, award, publish or make a binding commercial commitment.
• AI-assisted runs are recorded with the model used and a summary of input and output.

Operational resilience

Under Development

• Managed database backups are provided by the hosting platform.
• Recovery objectives, a recorded restore test and a written incident procedure are still to be completed.
• A published retention schedule and subprocessor register are in preparation.

Who sees what

Blind Buying and Visible Buying, stage by stage

Stage	Blind Buying mode			Visible Buying mode
Stage	Buyer sees	Supplier sees	Who can authorise disclosure	Supplier sees	Who can authorise reveal
Invitation	Blind ID of eligible suppliers and their category	The requirement only, never the buyer's name	Nobody: identities stay concealed	The requirement and the buyer's name	Buyer's Procurement Manager
Evaluation	Blind bidder numbers, prices and conformity	Their own submission only	Nobody	Their own submission only	Supplier names stay masked until approval
Approval	Blind bidder numbers and the recommendation	Nothing new	Nobody	Nothing new	Approvers within their spending limits
Award and fulfilment	Blind supplier ID; VEYRA passes documents between the parties	Blind buyer ID; VEYRA passes documents between the parties	Nobody: no automatic reveal after award	Supplier name, after an authorised reveal	Named Procurement Manager, with a reason recorded

In Blind Buying mode, buyer and supplier stay anonymous to each other for the whole transaction, with VEYRA in between. In Visible Buying mode, supplier identity is hidden during evaluation and revealed only after an authorised approval. In both modes these controls reduce exposure to relationship bias; they do not eliminate it.

Honest limits

What VEYRA does not claim

• No security or management-system certification is held (ISO 27001 and others are targets only).
• No live ERP integrations: SAP, Pronto, MYOB, Xero connections are demonstrations.
• No paying customers or verified savings are claimed; case material is labelled demonstration or modelled.
• VEYRA does not handle purchase payments.
• Legal, privacy and terms documents remain Draft for legal review.

Printable brief preview

VEYRA Global Technologies · Due-diligence summary

Enterprise & Investor Assurance Brief

Status as at 13 October 2026 · Pilot platform · Buy on merit. Not relationships.

Control status

Area	Status	Summary
Information security	Pilot	Security controls are maintained as part of the pilot environment and are being formalised for enterprise assurance.
Privacy	Implemented	Privacy notices, consent handling and organisation-scoped access are built into the current experience.
Authentication	Implemented	Authenticated portal access, password recovery and protected routes are in place.
Access control	Implemented	Roles and organisation membership control permitted actions; sensitive mutations are authorised on the server.
Data separation	Implemented	Organisation-scoped records and storage paths separate buyer and supplier information.
Row level security	Implemented	Database policies restrict records by authenticated organisation and role.
Audit logging	Implemented	Material procurement, approval and administration events are retained with actor, time and reference.
Backup and recovery	Under Development	Recovery objectives and enterprise operating procedures are being documented and tested.
Incident management	Under Development	Formal incident classification, escalation, communication and review procedures are in development.
Data retention	Under Development	Retention settings are being aligned to customer, legal and evidence requirements.
AI governance	Pilot	AI assists with parsing, matching and recommendations; human approval remains required for commercial decisions.
Human approval controls	Implemented	AI cannot publish, award, approve payment or make another irreversible commercial commitment.
Subprocessors	Under Development	The supplier register and customer-facing disclosure process are being prepared for enterprise review.

Data isolation — Implemented

Every buyer and supplier record belongs to one organisation.
Database row level security limits reads and writes to members of that organisation and their role.
Uploaded documents are stored in organisation-scoped paths.
Buyer reporting returns totals only and never names suppliers.

Tamper-evident audit trail — Implemented

Material changes are recorded by the database itself, so they cannot be skipped by going around the screens.
Each entry carries a fingerprint of the entry before it; editing or deleting a past entry breaks the chain and the check shows where.
Audit entries cannot be edited or deleted.
Identity reveals, approvals and permission changes record their reason and authority.

Blind evaluation and approvals — Implemented

Supplier identity stays hidden during the authorised blind stage.
Award approval follows the organisation's spending limits and delegations.
Countersignatures must be completed before an award is recorded.
These controls reduce exposure to relationship bias; they do not eliminate it.

AI governance — Pilot

AI may structure requirements, suggest matches and prepare recommendations.
AI cannot approve, award, publish or make a binding commercial commitment.
AI-assisted runs are recorded with the model used and a summary of input and output.

Operational resilience — Under Development

Managed database backups are provided by the hosting platform.
Recovery objectives, a recorded restore test and a written incident procedure are still to be completed.
A published retention schedule and subprocessor register are in preparation.

Not claimed

No security or management-system certification is held (ISO 27001 and others are targets only).
No live ERP integrations: SAP, Pronto, MYOB, Xero connections are demonstrations.
No paying customers or verified savings are claimed; case material is labelled demonstration or modelled.
VEYRA does not handle purchase payments.
Legal, privacy and terms documents remain Draft for legal review.

A control is marked Implemented only when it operates in the platform today. Evidence can be shown on request. Contact Sales@veyragroup.net · www.veyragroup.net/assurance

This pack describes a pilot platform. It is not a certification, audit opinion or legal advice.

Request an architecture and governance walkthrough

A focused session covering access, data separation, audit evidence, AI governance and the control roadmap.

Request a Demonstration Try the process simulation