eSupplier security to limit supplier to only see their own information

What is the security setup to only allow a supplier to see their own payment information? If they are limited through links on a page that directs them to another page without having to start at a search page, what would restrict a supplier from entering in a URL directly without search criteria to force them to the search page .. granted the supplier would have to be pretty savvy to do this but is there PeopleSoft security that would limit this and if so, what is that? It seems that row-level security only limits by business unit/setid