who can access our data in the file

Access is an institutional choice, not a platform choice

We do not determine who can access the supply chain file. The organization itself manages this, per user and per role. Someone who is only authorized to fill in identity data — such as the statutory name or the registration number of the registration — does not need to have access to, for example, the ISO 27001 status or the responses to banks. It is advisable to separate these once multiple colleagues are working on questionnaires, because not every department needs the same data to do its part.

In practice, this works with roles: an administrator who creates accounts and assigns rights, and users who can only read or can also confirm. Confidential fields — think of turnover figures or details about liability insurance — can be separated, even for users who otherwise have access to the file. Who sets this and how strictly is a choice of the organization. We store the data and display it to those who are authorized to access it; we make no substantive decision about who sees which field.

Why we have no role in this

This follows from how the platform is set up: we build the response side, we never log in to a client's portal and we do not read submitted questionnaires. Access management to your own file is therefore, like the maintenance of the sector in which the enterprise operates or the number of employees: data and settings of the client, not something we make a judgment about. This is separate from the requirements that may appear in questionnaires themselves about access control as a control measure — such as mentioned in Annex A of ISO/IEC 27001 or in the ten measures of article 21(2) of the NIS2 Directive. These requirements concern how the client's own organization is organized, not the settings within this platform.