Security

Nothing changes without your say-so

By default, every follow-up is a draft until you review and approve it, every send is a separate click, and a supplier's reply only ever updates the order once you click Apply. If you turn on auto-pilot (Growth and Unlimited plans, off by default), due follow-ups send on your behalf and a supplier's clear delivery update applies to the order automatically. Vague or unrelated replies still wait for you. You can turn it off at any time from Account, and everything it does still appears in that order's message history.

Accounts are kept separate

Every account's orders, drafts, and supplier replies are separated using database row-level security, in addition to checks in our application code, and the public database interface is closed to direct table access. No system is perfectly secure, so we do not claim ours is, and we do not intentionally expose one account's data through another account's session, subject to the limitations described in our Terms and Privacy Policy.

Google Sheet sync needs a shared link

If you link a Google Sheet, it must be shared as "Anyone with the link can view", so anyone who has the link can read it. Do not share that link, and turn the link sharing off when you stop syncing.

Encrypted in transit

All traffic to SupplierPing is intended to run over HTTPS. Password credentials are handled by our authentication provider and are not stored by SupplierPing in plain text.

Payments never touch our servers

Card details are handled entirely by Stripe, a payment processor that is certified to the PCI DSS Level 1 standard. We only ever see your subscription status, never your card number.

We never access your inbox

SupplierPing does not connect to your Gmail or any other mailbox, so it cannot read, send from, or change your email. Follow-ups are sent by SupplierPing with your address as the reply address.

Account deletion

Deleting your account removes your orders, uploads, drafts, and subscription record from active systems. Limited backups, logs, and records may remain for the periods described in the Privacy Policy.