One interface per role. Rights kept to the minimum.
Rights are checked server-side. Each export contains only the authorised columns. Every export and every account action is logged.
“What is this increase really worth, and on which items?”
- Announced increase
- +4.80%
- Net increase after discount
- +2.08%
- Pareto items
- 14
On our demonstration data set, a price list announced at +4.80% weighs only +2.08% net once the discount is applied.
“Which group entity gets the best price?”
- PE film 50µ · Valencia
- €4.31
- Best price · Gdańsk
- €3.61
- ERP links
- read-only
“Are negotiated prices applied in each entity?”
- Items with price not yet applied
- 37
- Entities concerned
- 2
- Longest delay · Porto
- 18 days
“Are orders placed at the agreed price on the order date?”
- Orders checked
- 1,284
- Gaps found
- 6
- Gap amount
- €1,930
“Can I read group sources without writing anything to them?”
- Power BI · Snowflake · SQL
- read-only
- Saved queries
- replayable
- Extractions
- logged
“Who has access to what, and who did what?”
- Active users
- 24
- Account actions
- logged
- Exports
- logged
| Right | Buyer | Supply planner | Purchasing management | Finance | Data architect | Administrator |
|---|---|---|---|---|---|---|
| See purchase prices and net prices | allowed | allowed | allowed | allowed | not allowed | allowed |
| See margins and selling prices | not allowed | not allowed | allowed | not allowed | not allowed | allowed |
| Arbitrate a match | allowed | not allowed | read-only | not allowed | not allowed | allowed |
| Edit ERP links | allowed | read-only | read-only | not allowed | not allowed | allowed |
| Prepare a pre-increase purchase | allowed | not allowed | read-only | not allowed | not allowed | allowed |
| Check of ordered prices | allowed | not allowed | read-only | read-only | not allowed | allowed |
| Read group data sources | not allowed | not allowed | not allowed | not allowed | allowed | allowed |
| Assign every profile | not allowed | not allowed | not allowed | not allowed | not allowed | allowed |
✓ allowed · L read-only · — not allowed. The administrator creates accounts and assigns profiles; other profiles, including data steward and purchasing manager, are not shown here.
Your data stays with you
Installed on site or in your private cloud. No price data leaves the company.
Read-only ERP access
Scheduled export, SQL view or web service. Buyvera never writes to your ERPs.
Verified backup
Corruption detection with quarantine, lossless updates with rollback.
Export and account log
Every export and every account action is logged.
When a buyer leaves
The portfolio of a buyer who leaves is handed to their replacement, and the history of their decisions stays readable.
Accounts deactivated, never deleted
A deactivated account can no longer sign in and its identifier is never reassigned. A new account is opened with a single-use code valid for 72 hours.
Company directory
In preparation, no committed dateSign-in through the company directory.
Security questionnaires
Handled case by case. No certification is claimed.
Designed so that your purchasing terms stay confidential in the quantum era.
A large enough quantum computer could break the key exchange that protects most connections today. The risk has to be prepared for now: traffic recorded today could be read later. Your purchasing terms are kept for five to ten years, which is a reason to plan ahead.
A connection already prepared
The server supplied with Buyvera negotiates TLS 1.3 with the hybrid X25519MLKEM768 key exchange: a classical algorithm combined with ML-KEM, the post-quantum algorithm standardised by NIST in 2024, as the European roadmap recommends. No setting needed on your side.
Mechanisms quantum computing does not threaten
The secrets and signatures of Buyvera rely on symmetric mechanisms and hashes (HMAC-SHA256 with a 256-bit key, bcrypt, SHA-256), which quantum computing does not break. Disk and backup encryption is part of how your installation is run.
Check it in two minutes
Open the tool in a recent Chrome or Edge, press F12, Security tab: the connection shows X25519MLKEM768. You can see it for yourself.
| Use | Mechanism | Against quantum |
|---|---|---|
| Browser ↔ supplied server connection | TLS 1.3, X25519MLKEM768 | protected (post-quantum hybrid) |
| Accounts and passwords | bcrypt | not threatened |
| Signed identity between interface and engine | HMAC-SHA256, 256-bit key | not threatened |
| Archives, log and backups | SHA-256 | not threatened |
Installed behind your own proxy, Buyvera inherits its TLS configuration: the hybrid exchange needs an up-to-date proxy (OpenSSL 3.5 or later for Apache and nginx). The product’s full cryptographic inventory is provided on request, for your own inventory. No certification is claimed.
Request the cryptographic inventory