Security review

Identity & access.

How people sign in to RazorERP, how roles decide what each person can do, how client portal users are managed, and how RazorERP limits and records its own staff’s access.

Request security documents Security overview

Run under a certified security program

RazorERP’s information security management system (ISMS) is certified to ISO/IEC 27001:2022 by DQS Inc., and its scope covers the design, development, operation, and support of the RazorERP SaaS platform. How access to the platform is granted, used, recorded, and removed is governed by documented policies and controls that the certification body audits.

This page summarizes those practices and the ISO/IEC 27001:2022 Annex A controls they follow. The detail and evidence your review needs are shared through your security review.

Signing in

Controls 5.16, 5.17, and 8.5.

01One account per personEvery user signs in with their own account, so each action can be traced to a person. Shared logins are not used.

02Single sign-onYour team can sign in through your company’s identity provider using OpenID Connect (OIDC), so your own sign-in rules apply to RazorERP.

03Multi-factor authenticationWith single sign-on, your identity provider’s multi-factor authentication and conditional access policies apply each time someone signs in.

04Protected credentialsSign-in credentials are protected under our controls for authentication information, and are never shared by RazorERP staff.

Roles and permissions

Controls 5.3, 5.15, and 8.3.

01Security rolesRoles define what each user can see and do, such as receiving, grading, pricing, settlements, or administration.

02Least privilegeGive people the access their work needs and no more. Sensitive functions can be limited to the roles that need them.

03Separation of dutiesRoles let you separate duties that should not sit with one person, such as preparing and approving a settlement.

04Your administrators decideYour own administrators create users and assign roles. RazorERP does not change your users’ access without your request.

Client portal users

Controls 5.15 and 5.18.

01Access you grantYour clients’ users see only what you give them access to, such as their own jobs, assets, certificates, and settlements.

02Their data onlyA client user can never see another client’s records.

03Removed when neededYou can remove a client user’s access at any time, for example when they leave their company.

The access lifecycle

Controls 5.16 and 5.18. Access for RazorERP staff follows these steps, and we recommend the same discipline for your own users.

01RequestAccess is requested for a specific person and purpose.
02ApproveSomeone with authority approves it.
03GrantOnly the access the role needs is given.
04ReviewAccess is reviewed regularly and corrected.
05RemoveAccess is removed promptly when it is no longer needed.

Activity records

Controls 8.15 and 8.17.

01Who did what, and whenKey actions on assets, such as receiving, grading, erasure evidence, disposition, and changes to records, are recorded with the user and the time.

02Chain of custodyThat history forms each asset’s chain of custody, which you can show to a client or an auditor.

03Protected logsSecurity logs are protected from tampering and reviewed, and system clocks are synchronized so events line up.

RazorERP staff access

Controls 6.1 to 6.6 and 8.2.

01Only when neededRazorERP staff access a customer’s data only when needed to provide support or operate the service, or when the customer asks.

02Approved and recordedPrivileged access to production is limited to authorized staff, protected by strong authentication, and recorded.

03Screened and trainedStaff are screened before they join, sign confidentiality agreements, and complete security awareness training.

04Removed on departureAccess is removed promptly when someone changes role or leaves, and confidentiality obligations continue after they leave.

Practices and their ISO/IEC 27001:2022 controls

Practice	Annex A controls
Access policy and least privilege	5.15 Access control · 8.3 Information access restriction
Individual accounts	5.16 Identity management
Credentials and sign-in	5.17 Authentication information · 8.5 Secure authentication
Granting, reviewing, and removing access	5.18 Access rights
Separation of duties	5.3 Segregation of duties
RazorERP privileged access	8.2 Privileged access rights
Activity records	8.15 Logging · 8.17 Clock synchronization
Staff screening, terms, and training	6.1 Screening · 6.2 Terms and conditions of employment · 6.3 Information security awareness, education and training
Departures and confidentiality	6.5 Responsibilities after termination or change of employment · 6.6 Confidentiality or non-disclosure agreements

Frequently asked questions

Does RazorERP support single sign-on?

Yes. Your team can sign in through your company’s identity provider using OpenID Connect (OIDC). We review your provider and its setup with you.

Is multi-factor authentication available?

Yes, through single sign-on: your identity provider’s multi-factor authentication and conditional access policies apply when your team signs in to RazorERP.

Can RazorERP staff see our data?

Only when needed to support you or operate the service, or when you ask. That access is limited to authorized staff, approved, and recorded.

How do we control what each person can do?

Your administrators assign security roles, which decide what each user can see and do.

How are our clients’ portal users managed?

You decide which client users have access and what they can see. Each client sees only its own records, and you can remove access at any time.

Are user actions logged?

Yes. Key actions on assets are recorded with the user and the time, and form each asset’s chain of custody.

IntegrationSingle sign-on with OIDCSign in through your identity provider.Open →CapabilityClient portalHow client users see only what you share.Open →

Need the detail for your review?

Tell us what your review requires and we will share the documentation.