Security review

Data protection.

How customer data is encrypted, kept separate, retained, exported, and deleted in RazorERP, who else may process it, and what happens if something goes wrong.

Request security documents Security overview

Run under a certified security program

RazorERP’s information security management system (ISMS) is certified to ISO/IEC 27001:2022 by DQS Inc., and its scope covers the design, development, operation, and support of the RazorERP SaaS platform. How customer data is classified, protected, kept, and deleted is governed by documented policies and controls that the certification body audits.

This page summarizes those practices and the ISO/IEC 27001:2022 Annex A controls they follow. The detail and evidence your review needs are shared through your security review.

Encryption

Control 8.24.

01In transitData moving between your browser or connected systems and RazorERP is encrypted.

02At restCustomer data and backups are encrypted where they are stored.

03Managed keysEncryption keys are managed under a documented cryptography policy, with access restricted to authorized staff.

Keeping customers apart

Controls 8.3, 8.11, 8.31, and 8.33.

01Separate customer dataEach customer’s data is kept separate from every other customer’s, and users can reach only the data of the organization they belong to.

02No customer data in testingProduction data is not used in development or test environments without authorization, and is masked where it is.

03Classified informationInformation is classified and handled according to its sensitivity, and customer data is treated as confidential.

Ownership and export

Controls 5.31, 5.33, and 5.34.

01Your data is yoursCustomers own the data they put into RazorERP. We use it only to provide and support the service, never for our own marketing.

02Take it with youCustomers can export their data, including before their agreement ends.

03Privacy commitmentsPersonal information is handled as our privacy policy and data processing terms describe, including the safeguards that apply to international transfers.

The data lifecycle

Controls 5.12 to 5.14, 8.10, and 8.13. What happens to customer data from the day it arrives to the day it is deleted.

01CollectYour team and your clients enter data, or connected systems send it.
02ProtectIt is encrypted, separated, and access-controlled.
03Back upEncrypted backups are kept separately from production.
04ShareOnly with the systems you connect and the subprocessors we use.
05RetainFor your agreement, then twelve months so service can resume.
06DeleteDeleted securely, including from backups as they expire.

Third parties

Controls 5.19 to 5.22.

01Subprocessors under contractThird parties that process data for RazorERP are reviewed for security and work under written data protection terms. The list is available to customers.

02Notice of changesCustomers are told before a new subprocessor begins processing their data.

03Systems you connectWhen you connect RazorERP to a carrier, marketplace, accounting system, or other provider, data moves on your instructions under your agreement with that provider.

If something goes wrong

Controls 5.24 to 5.28.

01Prompt notificationCustomers whose data is affected by a breach are notified without undue delay, with the information they need for their own obligations.

02InvestigationIncidents are contained and investigated, evidence is preserved, and causes are fixed.

03ImprovementEach incident is reviewed so that controls improve.

Practices and their ISO/IEC 27001:2022 controls

Practice	Annex A controls
Classifying and handling information	5.12 Classification of information · 5.13 Labelling of information · 5.14 Information transfer
Encryption and key management	8.24 Use of cryptography
Separating customer data	8.3 Information access restriction
Keeping production data out of testing	8.11 Data masking · 8.31 Separation of environments · 8.33 Test information
Backups	8.13 Information backup
Retention and deletion	8.10 Information deletion · 5.33 Protection of records
Privacy and legal requirements	5.31 Legal, statutory, regulatory and contractual requirements · 5.34 Privacy and protection of PII
Subprocessors and suppliers	5.19 to 5.22 Supplier relationships, agreements, and monitoring
Breach response	5.24 to 5.28 Incident management

Frequently asked questions

Is our data encrypted?

Yes. Customer data is encrypted in transit and at rest, and backups are encrypted. Keys are managed under a documented cryptography policy.

Can other RazorERP customers see our data?

No. Each customer’s data is kept separate, and users can reach only the data of the organization they belong to.

Who owns the data in RazorERP?

You do. We use it only to provide and support the service, as your agreement allows.

Can we export our data?

Yes, at any time, including before your agreement ends.

What happens to our data when we leave?

We keep it for twelve months after your agreement ends, so service can resume if you return, and then delete it. You can ask for earlier deletion.

Which third parties process our data?

Subprocessors under written data protection terms. Customers receive the current list, and are told before a new one begins processing their data.

Need the detail for your review?

Tell us what your review requires and we will share the documentation.

Request security documents Security overview