Polymr

Agents read from and write to named systems. They read items, BOMs, routings, inventory, open POs and production orders with field-level provenance from SAP, NetSuite, Oracle Fusion, Epicor and Microsoft Dynamics, and stage approved transactions back. Polymr can sync a mailbox and send on the customer's behalf from its own domain for Google Workspace, Microsoft and IMAP, and purchase orders go out from the application.

Writebacks use scoped permissions, and each connector and agent receives only the permissions its assigned workflow needs. The directory lists 55+ systems across ERP, CAD, data warehouses, file stores and accounting. Integration scope for a specific system is agreed during onboarding, so Polymr does not say how much of the directory is native as against wired up for each customer, and there is no surface for custom tools.

Sourcepolymr.tech/integrations, polymr.tech/docs section 06, polymr.tech/security; readread 2026-09-15

Work moves across the four agents with handoffs, fallbacks and deterministic steps. The chain runs from request and quote through procurement and planning to supplier follow through and outcome, and context, evidence and permissions pass from stage to stage along with the action history.

Where extraction is uncertain, the record is flagged for a person instead of written silently, and the Procurement Agent follows up on missing bids. Approval steps the customer configures sit between agent work and commitment, an award creates the purchase order from the quoted lines, and an accepted quotation converts to a sales order. Polymr does not describe workflow authoring, versioning or reuse, and detailed configuration guides come during onboarding.

Sourcepolymr.tech/workflows, polymr.tech/docs sections 03 to 05, polymr.tech homepage; readread 2026-09-15

Polymr both ingests the customer's own content and keeps a lasting retrieval layer over it. To ingest, a user uploads a file, forwards an email or lets a connected mailbox sync, and the document is parsed into structured records the user can review. That covers PDFs and spreadsheets as well as engineering drawings and CAD files, and files and extraction history stay attached to the job.

For retrieval, the privacy policy lists OpenAI for large language model and embedding processing, and the agents retrieve the relevant costs, inventory and history, along with suppliers, rules and constraints, structuring historical quotes, bids and price books along with specifications. New knowledge can be added without retraining. The embeddings layer appears on a subprocessor line, not described as an index.

Each extracted value keeps a link back to the document and the position it came from. Revisions are resolved, and uncertain extractions are flagged for a person. Named sources are the ERP, email and CAD, along with Snowflake, PostgreSQL, S3, SharePoint and Google Drive, and Polymr does not describe permissions for each source.

Sourcepolymr.tech/docs sections 02 and 06, polymr.tech homepage, polymr.tech/integrations, polymr.tech/privacy subprocessor table; readread 2026-09-15

The approval surface is Polymr's own, and the customer configures it inside the product. The customer's organization decides which quotations, supplier awards, purchase orders and outbound messages need sign-off and who gives it, and nothing with commercial effect leaves the system without passing those approval steps.

Approval queues show what is waiting, uncertain extractions are flagged for a person, and the 2 September 2026 changelog made item reconciliation step through one match at a time instead of a batch approval. The gate sits in Polymr, not in the customer's ERP. There is no routing of approvals into existing ticketing channels and no explanation of why a checkpoint fired.

Sourcepolymr.tech/docs sections 02 and 04, polymr.tech/security, polymr.tech/changelog; readread 2026-09-15

Access controls exist, but Polymr's own Security page says the certifications are pending. The customer's administrator invites users, assigns roles and sets which actions require approval, and multi-factor authentication is available and recommended for every user. Each connector and agent receives only the permissions its assigned workflow needs. There is no SSO, SAML or SCIM. Data handling is stated plainly.

Records are kept for the life of the contract and deleted within 30 days, customer data is never used to train shared models, and model providers are barred by contract from training on it. Staff MFA, quarterly access reviews and CloudTrail logging are Polymr's internal controls. No attestation is held yet.

Polymr lists SOC 2 Type II, ISO 27001 and GDPR certifications as pending and describes a SOC 2 Type II examination in progress, with the observation window opening in September 2026, monitored with Vanta, and the report going to a Trust Center when the examination completes. trust.polymr.tech leads to the application sign in, not a trust portal.

The homepage and Security page show SOC 2 Type II, ISO/IEC 27001 and GDPR + CCPA badge images, with alt text reading SOC 2 Type II and no hedge, beside the line saying those certifications are pending. Someone skimming the badges would read a certificate Polymr's own text says is not held.

Sourcepolymr.tech/security, polymr.tech/docs, polymr.tech homepage; readread 2026-09-15

An action history of the agents' own behavior can be inspected after the fact. Every agent action, approval, correction and writeback is logged for review. Every outbound message is recorded against the job, and the order history shows every send, edit and approval. Every approval, rejection and correction is recorded with the person and the time, and extraction history stays attached to the job.

There is no step by step inspection of prompts and model calls, no SIEM export and no retention by plan. The privacy policy's floor of at least 30 days for audit and system logs applies across the whole company, not as a plan setting, and CloudTrail and CloudWatch logging covers Polymr's own infrastructure, not the agents.

Sourcepolymr.tech/security, polymr.tech/docs sections 03 to 05, polymr.tech/privacy; readread 2026-09-15

Context carries between agents within a workflow, but there is no memory layer with a stated scope and lifetime. Polymr carries structured context, source evidence, permissions and action history from one stage to the next, so the procurement agent reuses the quote packet instead of rereading the drawing and the supplier agent keeps the assumptions used in the award through execution. No lifetime is stated for this context beyond the retention of all customer data for the life of the contract, and the customer cannot review, edit or delete it, or set its scope.

Polymr also names a private operational memory, built from approved quotations, corrections, supplier responses, exceptions and actual outcomes. Those are the business records themselves, and what the product learns from them across sessions is not a separate memory store. Deleting that memory would delete the business record. The shared live picture of current and historical plant data is likewise the application's own database.

Sourcepolymr.tech/workflows, polymr.tech homepage operational memory section, polymr.tech/security; readread 2026-09-15

Polymr runs as one hosted deployment in one region, with nothing to select. It is delivered as a hosted web application, each customer with its own address on polymr.tech and data kept logically separate, and the service runs entirely on Amazon Web Services in the United States. There is no dedicated, VPC, on premises or self hosted option. Nothing lets a customer pin model traffic or data storage to a region, and every subprocessor in the privacy policy, model providers included, sits in the United States.

Sourcepolymr.tech/security, polymr.tech/docs, polymr.tech/privacy; readread 2026-09-15

Four named agents each have their own inputs, steps and output. The Quote Agent turns RFQs, drawings and BOMs into a quote ready for approval, and the Procurement Agent takes supplier sourcing to a recommended award. The Planning Agent turns shortages into actions to buy, transfer, substitute or reschedule, and the Supplier Agent turns acknowledgments and delivery risk into recovery actions. Each works on its own.

Without the Quote Agent, procurement, planning and supplier follow through are each still whole jobs. The deployment path asks the customer to choose a high-value quotation, procurement or planning process to start with, so the customer picks among them. They are configured for rules, approvals, terminology and exceptions and integrated in 3 weeks, not built for each site. The four share one page, with no catalog entry, editability note or customer reference for each agent.

Sourcepolymr.tech/workflows, polymr.tech homepage agents and deployment sections; readread 2026-09-15

Nobody has to start the work. It reaches the agents through a connected inbox. A mailbox syncs, incoming documents and email threads are grouped into jobs, supplier replies come back into the same job, and quotes are parsed from the reply and attached to the request line by line. The agents detect requests and supplier replies, and a sourcing event starts from a demand, either a customer request, a planning shortfall or a manual request, two of which no person starts.

The Supplier Agent tracks acknowledgments, promised dates, missing documents, price changes and delivery risk. Email through Google Workspace, Microsoft and IMAP is fully supported. There is no schedule or webhook, and Polymr does not describe how it handles duplicates and races. An inbound RFQ starting the Quote Agent on its own appears in a product illustration, not in the docs, while the parsing and attachment of supplier replies is stated. iMessage and WhatsApp appear in the integrations directory with no described role.

Sourcepolymr.tech/docs sections 01 to 03 and 06, polymr.tech/integrations, polymr.tech/workflows; readread 2026-09-15

Two model providers are named in the inference path, but Polymr controls the choice. Among subprocessors that may process customer business data, the privacy policy names Anthropic for large language model processing for document understanding and agent workflows, and OpenAI for large language model and embedding processing for the same purposes. So two named providers handle customer business data in agent workflows, chosen on Polymr's side.

AWS, Google Workspace and GitHub on the same page, along with Cloudflare and Slack, are infrastructure or internal operations. There is no selector, workspace model policy or bring your own key option. Polymr does not say how work is split between the two providers, so routing on its side is inferred from the pair, not described.

Sourcepolymr.tech/privacy subprocessor table, polymr.tech/security data handling; readread 2026-09-15

The product is used only through its interface, with no API, SDK or MCP server. The documentation (updated 3 September 2026) covers the application's screens and says detailed configuration guides for the customer's own workflows come during onboarding, which are configuration guides, not a developer surface.

There is no API, developer or MCP page, and the docs., dev. and api. subdomains, like trust. and app.polymr.tech, lead only to the application sign in, so no developer site sits behind them. No MCP server or client is mentioned anywhere. Polymr reads and writes customer ERPs and databases, which is Polymr calling other systems, and SFTP and CSV in the integrations directory bring data in.

Sourcepolymr.tech/docs, polymr.tech/sitemap.xml, polymr.tech/integrations; readread 2026-09-15

Polymr validates an agent before its actions are enabled and runs an improvement loop after deployment, but publishes no evaluation result anyone can read. The deployment path has the customer validate the agent by configuring rules, approvals, terminology and exceptions and testing against historical and live work before enabling actions, then launch with supervision and measure the result.

Approved corrections and overrides become reusable precedent, and actual cost, supplier delivery, quality and quote outcomes improve future recommendations. The validation is a deployment step with no harness, score or pass rate, and the outcome loop feeds recommendations without measuring whether a change improved them. There is no scoring of output quality over time. The staged release pipeline in the 14 August 2026 changelog tests Polymr's own code, and the workbook import dry run (26 August 2026) previews a data import, not an agent change.

Sourcepolymr.tech homepage deployment and operational memory sections, polymr.tech/changelog; readread 2026-09-15

Every action goes through a connector, a mailbox or Polymr's own application, so there is no browser or computer control. ERP reads and staged writebacks, mailbox sync and sending from the customer's domain, and file parsing all run that way, and purchase orders go out from the order page. One lead stays open. Agents read vendor portal pricing and the integrations directory lists Vendor Portals, but no mechanism is described, so Polymr does not show that agents browse supplier portals.

Sourcepolymr.tech/integrations, polymr.tech/docs; readread 2026-09-15