Security and data handling
VQMap imports vendor security questionnaires, matches questions to control catalogues, supports human review and exports completed responses. This document explains the hosted and self-hosted architecture, the data VQMap keeps, the services it can contact and the limits of its security claims.
Architecture
VQMap runs as a React web application and a single Node service. The service owns parsing, retrieval, workflow enforcement and export. Customer content stays in the deployment's local database and document store; identity is handled separately by Supabase.
Storage and retention
Questionnaire text, answers, uploaded documents and extracted text are customer-confidential. Business content is not field-encrypted by the application, so production deployments require encrypted host and backup storage with restricted service-account access.