Security built in, not bolted on
TERTIQ is engineered for teams that treat their own security as seriously as their suppliers. Below is the actual posture and architecture of the platform today.
Deterministic risk engine
TERTIQ scores every supplier using a pure, deterministic, auditable weighting model. Seven inherent-risk inputs combine with fixed weights, with optional clamp-and-tier rules. All math lives in application code as pure functions with no network calls, no black-box ML, and no randomness. Results are reproducible across runs.
Tenant-aware data model
Every business record (supplier, assessment, evidence, finding, remediation, report, review) carries an organizationId foreign key scoped to the owning workspace. Multi-tenancy is enforced at the data model level with row-level ownership, and Prisma queries in application logic are written with organization filters.
Role-based access control
Five roles ship out of the box: OWNER, ADMIN, ANALYST, REVIEWER, VIEWER. Each capability is exposed through explicit rank-checked authorization helpers (canEditSuppliers, canManageAssessments, canReviewEvidence, canManageTeam, canManageBilling). Ownership and administration are strictly separated from read-only reviewer access.
Authentication architecture
TERTIQ uses Auth.js (v5) with passwordless email magic links and JWT session strategy. Sessions are signed, short-lived, and carry only the user id, role, organization id, email, and display name. Sign-in pages are served over HTTPS, and all dashboard and upload routes are protected by Next.js middleware that validates the session before any application code runs.
PostgreSQL on Neon
Primary data is stored in Neon PostgreSQL using the Prisma ORM. All database access is parameterized. Connections use TLS provided by Neon infrastructure. Backups, point-in-time recovery, and replication are handled by the Neon platform according to its published operational practices.
Vercel & HTTPS everywhere
The application runs on the Vercel platform. All public and authenticated traffic is served over HTTPS with modern TLS, including assets and APIs. Serverless routes expose short, bounded function durations. Static marketing content is pre-rendered and cached at the edge.
Principle of least privilege
Server-side code runs with the minimum credential scope required. Session tokens carry role and organization claims, and every mutation validates the caller against the RBAC helpers. Dashboard APIs and upload endpoints are gated by middleware, not only by UI chrome.
Data isolation approach
Customer data is logically separated per organization. Cross-tenant joins are not possible through the standard Prisma API surface because every row carries an organization scope. Evidence records are doubly scoped through both supplier and organization foreign keys.
Evidence handling
Evidence artifacts are first-class records with a declared EvidenceType, EvidenceStatus (UPLOADED, UNDER_REVIEW, ACCEPTED, REJECTED, EXPIRING, EXPIRED), EvidenceStrength (STRONG, MODERATE, WEAK), uploader, optional reviewer, and review notes. Evidence expiration is modeled explicitly and is surfaced both in scoring penalties and in UI views.
Platform and usage limits
TERTIQ enforces explicit rate and size ceilings configured in the limits module: maximum suppliers per plan tier, evidence file size caps, per-organization dashboard pagination, and bounded serverless execution durations. These are defense-in-depth safeguards against runaway usage and accidental cost spikes.
About this document
This page describes the current architecture and design posture of the TERTIQ platform. It is a factual statement of how the product is built today, and is updated as the platform evolves. Nothing on this page should be read as a formal compliance attestation. TERTIQ does not currently hold SOC 2, ISO 27001, NIS2, GDPR, or any other third-party certification. Formal audits or certifications, if completed at a later stage, will be listed here with full supporting documentation.
Responsible disclosure
If you believe you have discovered a security vulnerability in TERTIQ, please disclose it responsibly to the address below. We review every submission as part of standard platform operations. Please do not disclose vulnerabilities publicly before we have had a reasonable opportunity to investigate.
For general product enquiries or account matters, please use the account contact path established for your workspace, or the general correspondence channel below.
Want to go deeper? Review the supplier registration, assessment, evidence and reporting workflows inside your account, or ask for an architecture walkthrough with the TERTIQ team.