Skip to content
Vendrix

Security & architecture

Supplier documents and spend data handled with care.

How Vendrix is designed to protect procurement data, keep AI grounded in each organisation’s own records, and keep people in control of every purchasing decision — plus where the build stands today.

Current status: the website and interactive platform tour are built. The AWS services below are the production architecture being implemented for pilot workspaces. Vendrix does not currently hold security certifications; any future attestations will be listed here once obtained.

Design principles

Tenant isolation by design

Every record carries a workspace ID used as the DynamoDB partition key prefix and the S3 object prefix. API handlers derive the workspace from the signed-in user’s token, never from the request body.

Role-based access

Administrators, procurement managers, buyers, finance users, and reviewers have distinct permissions for uploading, confirming, approving, paying, and exporting.

People confirm uncertain data

Extracted fields below a confidence threshold must be confirmed or corrected before a document can feed comparisons, approvals, or payment checks.

Grounded, cited AI

Recommendations and copilot answers are generated only from the requesting workspace’s records and cite them. When the records do not contain an answer, the copilot says so.

Encryption and retention

Documents are encrypted at rest and in transit. Retention follows the customer agreement, with lifecycle rules for removal.

Audit trail

Uploads, field corrections, awards, approvals, rejections, payment holds, and dismissals are recorded with user and time.

Architecture on AWS

A document moves through five stages. Each stage is serverless, scales with document volume, and keeps the workspace boundary intact.

  1. 01

    Document intake

    Amazon API GatewayAmazon Cognito

    Authenticated upload endpoints; every request carries the user’s workspace and role.

  2. 02

    Secure storage

    Amazon S3Amazon DynamoDB

    Original files in tenant-prefixed, encrypted buckets; structured records partitioned by workspace.

  3. 03

    Extraction

    Amazon TextractAWS Lambda

    Text, tables, and key-value pairs read from quotes and invoices, then normalised into line items.

  4. 04

    Procurement intelligence

    Amazon BedrockAmazon EventBridge

    Explained recommendations, risk checks, and cited copilot answers; scheduled re-checks and reminders.

  5. 05

    Workspace experience

    AWS LambdaAmazon CloudWatch

    APIs behind dashboards, approvals, and audit trails, with metrics and alarms on every stage.

  • Amazon Textract: Extracts text, tables, and key-value pairs from supplier quotations, invoices, purchase orders, and contracts, including scanned documents.
  • Amazon Bedrock: Generates supplier comparison explanations, risk-alert summaries, and copilot answers grounded only in the workspace’s own records, with citations.
  • Amazon S3: Stores original supplier documents in encrypted, tenant-prefixed locations, with lifecycle rules for retention.
  • AWS Lambda: Runs the extraction pipeline, line-item normalisation, three-way matching, and the workspace API handlers.
  • Amazon API Gateway: Exposes authenticated REST endpoints for uploads, records, comparisons, approvals, and the copilot.
  • Amazon DynamoDB: Holds suppliers, documents, extracted fields, purchase orders, approvals, alerts, and audit events, partitioned by workspace ID.
  • Amazon Cognito: Manages sign-in, organisation membership, and the administrator, procurement manager, finance, and reviewer roles.
  • Amazon EventBridge: Schedules recurring checks such as overdue deliveries, stalled approvals, and periodic price-drift scans.
  • Amazon CloudWatch: Collects logs, metrics, and alarms for extraction latency, failed documents, and API errors.
  • Amazon Simple Email Service: Sends approval requests and alert notifications, and delivers website enquiries to the Vendrix team.

Implementation roadmap

AWS services are introduced in the order pilot customers need them, starting with the document workflow.

  1. Phase 1

    Foundations

    • Product definition, data model, and roles
    • Interactive platform tour on sample data
    • Website and lead capture defined as infrastructure-as-code

  2. Phase 2

    Pilot MVP

    • Organisation sign-in and roles with Amazon Cognito
    • Document upload to Amazon S3 and extraction with Amazon Textract
    • Supplier records and quote comparison on Amazon DynamoDB

  3. Phase 3

    Checks and approvals

    • Three-way matching and risk alerts
    • Threshold-based approval chains and audit trail
    • Scheduled checks and reminders with Amazon EventBridge

  4. Phase 4

    Intelligence

    • Explained recommendations and cited copilot with Amazon Bedrock
    • Spend analytics and savings tracking
    • Accounting and ERP export integrations

Have security questions about a pilot?

Email hello@vendrix.site or send a message with the topic “Security and data handling”.

Contact the team