Supplier access

Start with the approved supplier identity

A portal invitation connects an authenticated person to an existing supplier relationship in the buyer’s payable system. Keep the buyer legal entity and source supplier identity with that relationship. An email address or a similar company name cannot establish which financial records the person should see.

A supplier working with several buyers may have several explicit memberships. Switching workspaces changes the active authorised relationship. It must not merge invoices, payment details or internal conversations from separate buyer entities into one accessible record set. The invitation preserves who granted access and which relationship they approved.

Grant the right level of supplier access

Supplier User can submit permitted invoices, read their account’s published status and participate in vendor-visible cases. Supplier Admin additionally accepts eligible discount offers and requests changes to payment details. Those actions still follow the buyer’s financial and verification controls. The supplier role does not grant AP approval or bank execution.

Membership acceptance confirms the verified invited identity. A forwarded invitation must not open financial records to a different account. Access expires or is revoked through the retained membership state, and the underlying data checks that state on each request instead of relying only on a menu disappearing.

Keep every route within its buyer boundary

Invoices, payments, offers, documents and support cases all carry the vendor and buyer relationship. The API validates those references together. A user cannot change a vendor identifier in a saved request to retrieve another supplier’s remittance or attach a document to another buyer’s invoice.

Files need the same protection as table records. Protected document links recheck active scope and document visibility; they are not permanently public URLs. A revoked member who retained a link must lose subsequent access while the original document and its audit history remain available to authorised people.

Separate supplier conversation from internal review

A support conversation can contain vendor-visible messages and internal AP notes. Internal comments are excluded from supplier search, notifications, exports and direct record access. The distinction stays explicit on the record rather than depending on which page happened to display it.

The same rule applies to attachments. A vendor-visible file has an authorised owner and completed file checks before download. Internal review evidence or protected payment-destination references remain hidden from the supplier conversation. Access to a support case cannot serve as a shortcut into unrestricted financial documents.

Recheck access as relationships change

A supplier contact can leave the business or move to a different responsibility. Revoke or replace that membership without rewriting the actions the earlier principal performed. Pending notices recheck the recipient’s active relationship before sending. A suspended supplier may retain only the access expressly permitted by the buyer’s configured policy, while new invoice or financial actions remain blocked. These checks protect the portal after onboarding as well as on the first sign-in.