Trust & Security
Security practices built into the architecture
These aren't add-ons — they're part of how the platform's services are designed, from the data model up.
Encryption in transit
TLS is enforced across every service-to-service and client-to-service connection — no exceptions carved out for internal traffic.
Tenant data isolation
Row-level business scoping is enforced at the data-access layer for every tenant-owned table, so one missed check in a screen can't leak data across businesses.
Server-side authorization
Role-based access control is checked on every mutating request server-side, regardless of what a particular client interface happens to hide.
Audit trail by design
Routing decisions, pricing resolutions, and order state transitions are recorded as they happen — not reconstructed after the fact from application logs.
Upload scanning
File attachments (RFQ documents, bulk catalog uploads) pass through malware scanning before they're accepted.
Idempotent, safe retries
State-changing requests like order creation require an idempotency key, so a network retry or double-click can never create a duplicate order or double-charge a business.
Responsible disclosure
Found a security issue?
We take security reports seriously and ask that you report suspected vulnerabilities to us privately before any public disclosure, so we have a chance to investigate and fix the issue. Email security@need-x.com with details and, where possible, steps to reproduce. We aim to acknowledge reports within two business days.