How ProcureCortex handles your vendors’ documents.
You hold your vendors to a standard. This page is where we show you ours: where documents live, who can see them, which services process them and how every decision is recorded.
Documents
Every file the vendor sent, with its reading status.
| Document | Vendor | Type | Status |
|---|---|---|---|
| HIPAA_BAA_Helix_Health_2026.pdf | Helix Health Data | Business Associate Agreement | Indexed |
| Subprocessor_List_Helix_v7.pdf | Helix Health Data | Subprocessor list | Indexed |
| DPA_Atlas_Logistics_2026.pdf | Atlas Logistics | Data Processing Agreement | Indexed |
| MSA_Atlas_Logistics_signed.pdf | Atlas Logistics | Master Services Agreement | Indexed |
| Kestrel_SOC2_TypeII_2026.pdf | Kestrel Payroll | SOC 2 Type II report | Reading clauses… |
What we can show today.
Controls that are part of the product for every customer, in every plan.
Private storage per workspace
Each customer’s documents are kept in their own private storage.
In every planRole-based access
Admin, reviewer, compliance officer and viewer roles, each with its own permissions.
In every planMulti-factor sign-in
Password sign-in with time-based one-time codes.
In every plan
The software recommends. People make the call.
Your auditor will ask why a vendor was accepted. The answer is already on the record.
People make the call
Findings are recommendations. A reviewer accepts one, overrides it or asks the vendor, and an override is saved with its reason. Every change records who, when and why.
Decision history
The original result and every reviewer change stay on the assessment. Nothing is overwritten, so the trail from decision back to document holds.
AI and your documents.
Reading documents and checking rules runs on separate processing services. The sub-processors involved are listed here and in our DPA, and any change is notified in advance.
Privacy Policy| Sub-processor | Purpose | Data |
|---|---|---|
| Google Cloud (Gemini) | Reading and extracting clauses | Document text |
| OpenAI | Embeddings for clause matching | Clause text |
| Pinecone | Search across clauses | Embeddings |
| Supabase | Application database and storage | Workspace data |
For your security review.
Ask for any of these and we send them within two working days.
Request our security pack- Data processing agreementOur standard DPA, ready to sign.
- Sub-processor listWith purpose and location for each.
- Security overviewArchitecture, access control and encryption.
- Completed questionnaireAnswers to a standard security questionnaire.
- Data retention termsWhat we keep, and for how long after you leave.
- Incident notice termsHow and when we tell you.
Questions from your security team?
Open a demo workspace with a sample vendor, its documents and its findings. Or bring your own vendor to a 30-minute call.