Security review

Hosting, resilience & recovery.

How RazorERP hosts, monitors, backs up, tests, and recovers its platform, under an information security management system certified to ISO/IEC 27001:2022.

Request security documents Security overview

Run under a certified security program

RazorERP’s information security management system (ISMS) is certified to ISO/IEC 27001:2022 by DQS Inc. Its scope covers the design, development, operation, and support of the RazorERP SaaS platform, so the way the platform is hosted, changed, monitored, and recovered is governed by documented policies and controls that are audited by the certification body.

This page summarizes those practices and the ISO/IEC 27001:2022 Annex A controls they follow. The figures and evidence your review needs, such as the hosting provider and region, recovery objectives, and test results, are shared through your security review.

Hosting environment

Controls 5.23, 8.20 to 8.22, and 8.31.

01Commercial cloud infrastructureThe platform runs in data centers operated by a commercial cloud infrastructure provider. The provider is selected, contracted, and reviewed under our controls for cloud services and suppliers, and is responsible for the physical security, power, and cooling of its facilities.

02Separate environmentsProduction runs separately from development and test environments, and customer data is not copied into them without authorization.

03Network protectionNetworks are segmented, and services are reachable only on the paths they need. Traffic to and from the platform is encrypted in transit.

04Restricted administrative accessOnly authorized staff can administer production. Access is granted by role, protected by strong authentication, recorded, and reviewed.

Availability and capacity

Controls 8.6, 8.14, and 8.32.

01A contractual availability commitmentOur service level agreement commits to 99.5% monthly availability, with service credits if we miss it.

02Capacity planningUse of computing resources is monitored and planned for, so the platform keeps up as customers grow.

03RedundancyRedundancy requirements are identified for the components the service depends on, and implemented to meet our availability commitments.

04Controlled changeChanges to production are planned, reviewed, tested, and approved before release. Maintenance that could affect customers is scheduled at times of low use and announced in advance where practicable.

Backup, continuity, and recovery

Controls 5.29, 5.30, and 8.13.

01Regular backupsCustomer data is backed up on a defined schedule under a documented backup policy.

02Protected copiesBackups are encrypted and kept separately from the production systems they protect.

03Restores are testedRestoring from backup is tested, so recovery is a practiced process rather than an assumption.

04Continuity and disaster recoveryBusiness continuity and disaster recovery plans define how service is restored after a major disruption, and are reviewed and exercised.

Monitoring and vulnerability management

Controls 8.7 to 8.9, 8.15, 8.16, and 8.25 to 8.29.

01Logging and monitoringSecurity-relevant events are logged, protected from tampering, and monitored, so unusual activity is detected and investigated.

02Vulnerability managementSystems are scanned for known vulnerabilities, and findings are assessed by risk and fixed within defined timeframes. Operating systems and components are kept patched.

03Hardened configurationServers and services are built from approved configurations and protected against malware.

04Secure developmentSecurity requirements are part of design. Code is reviewed, and security testing is part of the release process.

Penetration testing

Control 8.29. The RazorERP platform is penetration tested on a regular schedule and after significant changes. Each test follows the same cycle.

01ScopeThe web application, its APIs, and the infrastructure behind them.
02TestTesters attempt real attacks, such as broken access control, injection, and authentication bypass.
03ReportEach finding is rated by severity, with the evidence to reproduce it.
04FixFindings are fixed in order of severity, within defined timeframes.
05RetestFixes are retested to confirm they work.
06ReviewResults feed back into our risk assessment and secure development practice.

Testing you can review

A summary of the most recent penetration test, including its scope, dates, and the status of findings, is available to customers and organizations evaluating RazorERP. Request it through our security documents page.

If your organization needs to run its own test against RazorERP, contact us first. Testing requires our written permission and an agreed scope and schedule, as our acceptable use policy explains.

Incident response

Controls 5.24 to 5.28.

01A documented planRoles, escalation paths, and procedures for security incidents are defined in advance and practiced.

02Assessment and responseEvents are assessed and classified, and incidents are contained, investigated, and resolved, with evidence preserved.

03Customer notificationCustomers whose data is affected by a breach are notified without undue delay, with the information they need to meet their own obligations.

04LearningEach incident is reviewed so that its causes are addressed and controls improve.

Reporting a security issue

If you believe you have found a vulnerability in RazorERP, report it to support@razorerp.com. Please give us a reasonable chance to fix it before sharing it with others.

Practices and their ISO/IEC 27001:2022 controls

Practice	Annex A controls
Cloud provider selection and review	5.19 to 5.23 Supplier relationships and use of cloud services
Network protection and segmentation	8.20 Network security · 8.21 Security of network services · 8.22 Segregation of networks
Encryption in transit	8.24 Use of cryptography
Administrative access	5.15 Access control · 8.2 Privileged access rights · 8.5 Secure authentication
Separate environments	8.31 Separation of development, test and production environments · 8.33 Test information
Capacity and redundancy	8.6 Capacity management · 8.14 Redundancy of information processing facilities
Change control	8.32 Change management
Backup and restore testing	8.13 Information backup
Continuity and disaster recovery	5.29 Information security during disruption · 5.30 ICT readiness for business continuity
Logging and monitoring	8.15 Logging · 8.16 Monitoring activities · 8.17 Clock synchronization
Vulnerability and patch management	8.8 Management of technical vulnerabilities · 8.7 Protection against malware · 8.9 Configuration management
Secure development and penetration testing	8.25 Secure development life cycle · 8.28 Secure coding · 8.29 Security testing in development and acceptance
Incident response	5.24 to 5.28 Incident management, from planning to collection of evidence

Questions reviewers ask

We answer these with documentation and evidence through your security review.

Hosting environment

Where the application and customer data are hosted.

Which hosting provider and regions are used?
Which certifications does the provider hold?

Backup & recovery

How data is protected against loss.

How often is data backed up, and for how long are backups kept?
What are the recovery point and recovery time objectives?

Penetration testing

Independent evidence that controls work.

When was the last test, and what did it cover?
Are any findings still open?

Frequently asked questions

Is RazorERP ISO 27001 certified?

Yes. RazorERP is certified to ISO/IEC 27001:2022 by DQS Inc., certificate 31619142 ISMS22. The scope covers the design, development, operation, and support of the RazorERP SaaS platform. You can download the certificate from our ISO/IEC 27001 page.

Is RazorERP penetration tested?

Yes. The platform is penetration tested on a regular schedule and after significant changes. Findings are fixed by severity and retested, and a summary of the latest test is available through a security review.

Can we run our own penetration test?

Contact us first. Testing RazorERP requires our written permission and an agreed scope and schedule, so that your test does not affect other customers.

Where is RazorERP hosted?

In data centers operated by a commercial cloud infrastructure provider. The provider, the regions used, and the provider’s certifications are shared during your security review.

What uptime does RazorERP commit to?

Our service level agreement commits to 99.5% availability each calendar month, with service credits if we fall short.

How is customer data backed up?

On a defined schedule, with encrypted backups kept separately from production. Restores are tested, and continuity and disaster recovery plans are reviewed and exercised.

Need the detail for your review?

Tell us what your review requires and we will share the documentation.

Request security documents Security overview