A plain-language summary for technical evaluators, IT directors, and security teams. This is a sales and evaluation resource, not a binding legal document; contractual security commitments are set out in the Data Processing Agreement and its Annex 3.
How we keep your data separate from every other tenant
Every record in Vantage belongs to a tenant, and every database query is scoped to that tenant at the application level. Tenants can't see, query, or accidentally access another tenant's data. A partner record groups multiple tenants under a single Market Partner for gain-share reporting, but this grouping doesn't collapse the underlying tenant-level data isolation.
How we protect data in transit and at rest
Data is encrypted in transit and at rest. API access requires Bearer token authentication scoped to your tenant, and each tenant can hold multiple API keys to isolate usage across different internal systems, such as billing versus a field tool, with independent revocation.
How we handle credentials
API keys and webhook secrets are stored encrypted, not in plain text. Outbound field dispatch integrations use HMAC SHA-256 signed payloads so the receiving system can verify a request genuinely came from Vantage.
How we control who sees what inside Priimal
Access by Priimal personnel to your data is limited to what's necessary to provide support and operate the Platform, and is logged. There's a single unified super-admin panel for managing tenants, Market Partners, and billing, access to which is restricted to authorised Priimal staff.
How we log what happens to a case
Every significant case action, status changes, assignment changes, notes added, recovery events, AI re-score events, and field work order dispatch events, is automatically recorded in a full audit trail, visible on the case and included in PDF exports. This gives you a defensible record of who did what, and when, for every case in your account.
How authentication works for your users
Every Authorised User has an individual login. Two-factor authentication is available to every user, and the platform actively prompts users to enable it at signup with periodic reminders thereafter. We recommend every organisation enable 2FA account-wide as a matter of policy, even though the platform itself treats it as optional per user.
What happens if something goes wrong
Priimal maintains a personal data breach notification process, committing to notify affected Customers without undue delay, and in any event within 48 hours of becoming aware of an incident affecting their data, with full detail set out in the Data Processing Agreement.
Where your data lives, and who else touches it
Vantage runs on a Laravel/PHP application stack with a MySQL database, hosted in Finland, within the European Economic Area. AI risk scoring is performed via a direct API call to Anthropic; no intermediary vendor sits between Vantage and the AI provider. Transactional email is delivered via Brevo. The AI provider is based in the United States, and transfers to it are covered by Standard Contractual Clauses. A full, current sub-processor list is available in the Data Processing Agreement and on request.
What's on our roadmap
We're candid that some security capabilities are still maturing. Third-party penetration testing is planned, and we'll share results with Customers once complete. A formal uptime SLA and dedicated infrastructure monitoring are also in active development; current commitments are set out in the Service Level Agreement and will be strengthened as this work progresses.
Where to go for more
- Contractual security commitments: Data Processing Agreement, Annex 3.
- Uptime and support commitments: Service Level Agreement.
- AI-specific transparency: AI Transparency and Human Oversight Statement.
- Questions from your security or procurement team: connect@priimal.com.