Procurement kit
Approve TradeProof without a sales call
Everything your purchasing, IT or legal team usually asks for, ready to download. Print any page with Save as PDF.
Security questionnaire (pre-filled)
19 common questions answered. Opens in Excel or Google Sheets.
Terms and data protection
Standard Terms of Service and our Data Processing Agreement (DPA), with the list of subprocessors.
Invoices and annual payment
Paddle is our Merchant of Record: it sells TradeProof to you, issues invoices with your company details and handles sales tax. Yearly plans: 2 months free (Pro $890/year, Business $1990/year). 30-day money-back guarantee.
Security questionnaire
- Company and product
- TradeProof, a Caellum product. Subcontractor insurance (COI) and W-9 compliance software.
- Hosting provider
- Lovable Cloud, built on Supabase (PostgreSQL).
- Data location
- Our providers may store and process data in the United States and other countries (see Privacy Policy). Ask support@usetradeproof.com for details.
- Encryption in transit
- Yes — HTTPS/TLS for all traffic.
- Encryption at rest
- Yes — by the hosting provider. W-9 tax IDs are additionally encrypted by the application (AES-GCM); only the last 4 digits are shown.
- Backups
- Managed by the hosting provider.
- Multi-factor authentication
- Yes — authenticator-app two-step verification for all users; required for TradeProof staff.
- Password policy
- At least 10 characters with letters and numbers; common passwords and the account email are refused.
- Tenant isolation
- Row level security in the database limits every query to the customer's own company.
- Staff access to customer data
- Read-only support access, only with two-step verification; every admin action is recorded in an audit log.
- Document storage
- Private storage; files open only through signed links that expire after 5 minutes; uploaded file types are verified.
- Audit logging
- Customer activity history, email log and admin audit log.
- Data export
- Customers can download all their data as a ZIP at any time.
- Data deletion
- Account deletion from Settings; all data is permanently deleted after a 30-day grace period.
- Card data / PCI
- TradeProof does not store or process card numbers. Payments are handled by Paddle, the Merchant of Record.
- Subprocessors
- Lovable Cloud (built on Supabase) (Hosting, database, file storage, logins); AI model provider (through Lovable Cloud's AI gateway) (Reading uploaded certificates and W-9s); Resend (Sending emails (requests, reminders, notices)); Paddle (Payments, invoices and sales tax (Merchant of Record))
- Breach notification
- Affected customers are notified without undue delay and as required by law.
- Security contact
- support@usetradeproof.com
- Certifications
- No third-party certification yet (e.g. SOC 2).
Need a document that isn't here? Email support@usetradeproof.com.