Security

These practices help keep your VendorGate account and vendor data secure.

Use narrow credentials

Create a separate credential for each external system and grant only the permissions VendorGate needs. For example, an SFTP credential for a vendor should only have read access to the inbound folder, not full access to the server.

Rotate secrets regularly

Update passwords, API keys, and tokens before they expire. Because credentials are referenced by name, rotating one credential updates every pipeline and monitor that uses it.

Limit team roles

Assign the lowest role that lets a team member do their job. Avoid making everyone an admin.

Monitor access

Review team membership periodically. Remove former employees and contractors promptly.

Secure webhooks

When configuring webhook alerts, use HTTPS endpoints and keep the signing secret private. Verify the signature on incoming requests to confirm they came from VendorGate.

Do not embed secrets

Never paste secrets directly into pipeline or monitor configuration. Always use a credential.