Product evidence deserves deliberate access, handling and review. Understand the implemented workspace controls and the operational arrangements your deployment still needs.
The application enforces access and evidence workflows. Hosting, provider configuration, security assurance and contractual responsibilities require deployment-specific review.
Accounts use server sessions and verified email. Organisation roles control changes, review, exports and administration. Customer access and platform operations use separate sessions.
Supplier response links give access to a single request without a customer account.Uploaded sources enter quarantine before processing. Document versions retain their integrity reference, screening state and review decision. Private downloads require authorised workspace access.
Screening and storage availability depend on deployment configuration.Agree on hosting, data location, incident handling, retention and service responsibilities before introducing sensitive evidence into a deployment.
No security certification, independent audit or service-level guarantee is claimed.A starting point for technical discovery and procurement review.
| Area | Workspace behaviour | Deployment review |
|---|---|---|
| Identity & access | Verified accounts, organisation roles and scoped supplier capabilities. Platform administrators use a separate MFA session. | Account lifecycle, role assignment, operator provisioning and any additional identity-provider requirements. |
| Hosting & data location | Workspace records are server-side. Private source storage and provider operations use the configured deployment services. | Hosting provider, geographic location, data flows, subprocessors and contractual responsibilities. |
| Retention & deletion | Account and organisation deletion requests require password confirmation and offer a 30-day cancellation period. | Retention policy, deletion process, backup handling, recovery requirements and export arrangements. |
| Document provenance | Versioned source records retain integrity references, screening state and review provenance. Authenticity still requires reviewer judgement. | Source acceptance criteria, storage policy, malware scanner configuration and reviewer responsibilities. |
| Review & activity | Reviews refer to a specific source version. Server-recorded activity identifies workspace actions and administrative reasons. | Authorisation, review responsibilities, audit retention and any required protection against alteration. |
| Operational assurance | Provider failures and blocked configuration are reported explicitly. No availability commitment or independent security assessment is claimed. | Incident process, support responsibilities, availability objectives, testing and review of security evidence. |
Define the people, information and decisions involved before enabling a shared production deployment.
Prepare a pilot scopeMap internal teams, external suppliers and reviewers to the information each should be able to see or change.
Identify the document types, product data and commercially sensitive information within the proposed collection.
Assign the review owner and define how exceptions, approvals and changes will be documented.
Agree on the evaluation, export, retention and deletion process before the pilot starts.
Capture the governance, technical and support questions that matter to your team in a pilot enquiry.