What we do, what suppliers must show.
Plain statements about the platform's current safeguards and the supplier review model. No certifications are claimed that we do not hold.
Safeguards in this version.
Authentication
Email-verified sign-in through a maintained authentication library. No passwords are stored for standard accounts. Multi-factor authentication is available for Silver River staff and required before production use.
Access control
Every protected request is authorised on the server at the organization and case level. Buyers never see other buyers; suppliers never see other suppliers' quotes or buyer identities until released.
Separated conversations
Buyer–Silver River, supplier–Silver River and internal notes are separate threads. Shared threads exist only when a Silver River admin creates one and chooses the participants.
Documents
Files are stored outside the public web root and served only through access-checked endpoints with size and type limits. Malware scanning is a defined step in the pipeline.
Secrets and logs
Secrets live in environment configuration, never in the front-end bundle, logs, emails or message threads.
Audit trail
Status changes, supplier approvals, quote publication and admin actions are written to an audit log.
Data minimisation
We do not collect training data, model weights or your compute credentials. Workloads do not run through Silver River.
Supplier review model
Each supplier is reviewed against the areas below. Approval is per company; capacity verification is per listing.
- 01Company identity and authorisation to resell or operate
- 02Identity and permission management
- 03Dedicated vs shared tenancy
- 04Network, compute and storage isolation
- 05Data encryption and deletion
- 06Data location: countries and regions
- 07Administrator access and audit logging
- 08Incident reporting and support responsibilities
- 09SLA and acceptance procedure
- 10Certification documents: scope and validity