kohlvexProduct status
Kohlvex is at the focused-pilot stage. Described technical controls are based on the reviewed V1.2 documentation and selected source code, not an independent security audit or proof of the running deployment.
Source and review
The documented workflow links records to source files and locations and distinguishes interpretation, validation and human verification. Under the default policy, PCF and other higher-risk claims require human review.
Access boundaries
The documented model includes organization-scoped access, server-side roles and authorized file downloads. Supplier response links are designed to be scoped, expiring and revocable, rather than giving suppliers general workspace access.
AI processing
The reviewed interpretation path passes extracted candidate text, field definitions, document metadata and relevant supplier/product context to the configured AI provider. The path does not send original file bytes. Provider terms and processing locations must be agreed for a pilot.
Storage and deletion
Original files use managed object storage and derived records use a database. Hosting region, backups, export, retention and deletion arrangements must be confirmed for the proposed deployment.
Current boundaries
No SOC 2 or ISO 27001 certification is claimed. Enterprise SSO, packaged ERP/PLM integrations and verified upload malware scanning should not be assumed available.
Agree these before a pilot.
- Permitted document types and authorized reviewers.
- Hosting location and service-provider arrangements.
- AI data-processing terms and confidentiality restrictions.
- Retention, export, backups and deletion.
- Support and incident-response responsibilities.
These descriptions are not a certification, third-party assessment or representation that every control was verified in production.