1
Via Rheinvalor
Software as a service in the Swiss cloud.
- Operation, updates and backups by Rheinvalor
- Application, database, files and backups in Switzerland
- Sign-in with a one-time code by e-mail, no password
- Runs in the browser, no installation
For your IT
IT and security, laid open.
What your IT wants to know before you start: where the data is stored, how ProcureValor is built, how sign-in works and which operating model you run the suite in.
Developed in Switzerland and 100 % hosted in Switzerland.
Operating models
Three ways to run ProcureValor.
Same code, same features. You choose where the suite runs and how your people sign in.
2
With Microsoft Entra ID
Sign-in with the company account (single sign-on).
- Your staff sign in with their Microsoft account
- Set per customer: in addition to code sign-in or as the only sign-in
- Your multi-factor and access rules in Entra apply
- Suppliers keep signing in with a one-time code
3
As an instance in your Azure environment
ProcureValor runs in your own Azure subscription.
- Own database and own file storage in your Azure environment
- Region of your choice, for example Switzerland North
- Sign-in via your Entra tenant, logs into your monitoring
- Controlled updates, with rollback to the previous version
All three models use the same code. Differences come only from settings, not from custom builds.
Discuss the modelHosting and data
Your data stays in Switzerland.
In models 1 and 2, ProcureValor runs entirely in Swiss data centres. In model 3, the data is stored in your own Azure environment, in the region you decide.
Data centreSwiss cloud, data centre in Geneva
Data storageApplication, database, files and backups exclusively in Switzerland
BackupDaily, encrypted, in Switzerland; restore tested
Swiss AIAI features only after explicit consent, processing in Switzerland
Architecture
One core for all modules.
ProcureValor is our own software, developed in Switzerland. All modules share the core, the database and the permissions.
Your browserNo installation, no plug-in, on PC, tablet and phone
ConnectionHTTPS only, with HSTS
ApplicationPython and Django, one shared core for all modules
DatabasePostgreSQL, reachable only internally
FilesDelivered only through views with permission checks
Built withPythonDjangoPostgreSQLHTML and CSSJavaScript
Security
Security in the code, not just in the brochure.
Sign-inOne-time code by e-mail, short validity, limited attempts, lockout on misuse; Microsoft Entra ID on request
Roles and tenantsPermissions checked centrally on the server, each customer sees only their own environment
Audit trailEvery change with person and time, cannot be altered in the application
UploadsOnly permitted file types, size limit, protection against path manipulation
No third partiesNo trackers, no CDN, no cookies on the websites
Penetration testsRegular external penetration tests, with access to the code and attacks from outside
Code scanningCode and the libraries used are scanned automatically for vulnerabilities
TestedMore than 4'000 automated tests on every change
Evidence
What we can prove.
CSA STAR Level 1Self-assessment based on CAIQ v4.1, published in the CSA STAR Registry
swiss made softwareMember, software developed in Switzerland
swiss hostingMember, hosting in Switzerland
Hosting partnerCertified to ISO 27001 and ISO 9001
Contact for IT
We answer your IT's questions directly.
We discuss security documents, questionnaires and architecture with your IT. Security reports to security@procurevalor.com.