ISO/IEC 27001
We align our Information Security Management practices to ISO/IEC 27001 controls. Certification scope and current status are maintained in our
Security Practice.
- Risk management and control ownership
- Access control, asset management, change management
- Security awareness, incident response, and business continuity
PCI DSS
For payment flows that touch cardholder data, we follow PCI DSS requirements appropriate to the integration pattern (e.g., hosted fields, redirect, or third-party processor). Implementation details and responsibility matrices are documented per customer.
Data Encryption
- In transit: TLS 1.2+ for all customer endpoints.
- At rest: industry-standard encryption for databases, file storage, and backups.
- Enterprise options: enhanced key management; integration with your cloud KMS where applicable.
Your Data — Backups and Exports
You control your data. On request we provide a time-bound export/backup in a standard format. Long-term retention and custom formats are available on Enterprise plans.
Single Sign-On (Enterprise)
Enterprise plans include SSO with your identity provider (SAML 2.0 / OIDC). We support just-in-time provisioning and role mapping aligned to your security policy.
SAP ISA-M Integration Maturity
Our integration approach follows SAP ISA-M to reduce point-to-point risk, standardize contracts, and keep analytics dependable. This framework underpins how we connect ERP, commerce, and analytics layers.