Security & Trust

1. Our approach

EzraPro holds our customers' purchase orders, quotations, supplier data and documents. We protect that information with layered controls: strong sign-in, strict separation of each customer's data, encryption, continuous monitoring, and a secure development process. Our security programme is documented in a set of written policies that we review at least once a year.

2. Hosting and infrastructure

• EzraPro runs on Amazon Web Services (AWS). AWS data centres are certified to SOC 1, SOC 2, ISO 27001 and other standards; physical security is provided by AWS.
• Application servers, the database and file storage run in private networks. The database is not reachable from the internet.
• All traffic enters through a load balancer that only accepts encrypted connections.

3. Encryption

• In transit: HTTPS only, TLS 1.2 and above (TLS 1.3 preferred). Plain HTTP is redirected to HTTPS.
• At rest: the database, its backups and all stored files are encrypted with AES-256.
• Documents are shared through short-lived, signed links rather than public addresses.
• Passwords are stored only as salted hashes. Application secrets are kept in a managed secrets store, never in code.

4. Sign-in and access control

• Two-step sign-in is mandatory for every user, with an authenticator app; passkeys can be added.
• Password rules follow enterprise practice: minimum length, checks against known breached passwords, no reuse of recent passwords, and lock-out after repeated failed attempts.
• Role-based access: each person sees only what their role allows (for example Master Admin, Manager, Team Lead, Agent, Buyer). Company administration is limited to the customer's own administrators.
• Our own staff access to production is limited to the people who need it, protected by multi-factor authentication, and recorded.

5. Separation of customer data

Every record belongs to one customer company. The application checks the signed-in company on every request, and the database itself enforces the same separation with row-level security, so one customer cannot read another customer's data even if an application check were missed. Data is shared between companies only where the customers have set up a connection themselves (for example a purchase order issued to a connected supplier).

6. Secure development

• Every change to production code goes through a reviewed pull request; the main branch is protected.
• Automated scanning on every change and every week: static code analysis, secret detection, and checks of every third-party library for known vulnerabilities.
• A weekly automated scan of our public websites, and scanning of every server image before it is deployed.
• Security fixes are prioritised by severity, with defined time limits for critical and high issues.

7. Monitoring and logging

• All administrative activity on our cloud account is recorded in tamper-evident audit logs.
• Automated threat detection watches our cloud account for suspicious activity.
• Application and access logs are kept for investigation; important actions on purchase orders and RFQs are recorded in each record's history.

8. Backups and continuity

• The database is backed up automatically every day, with point-in-time recovery for the last 14 days.
• The database is protected against accidental deletion.
• Application code and server images are versioned, so the service can be rebuilt from source.
• We maintain a written business continuity and disaster recovery plan.

9. AI and your data

EzraPro uses AI models to read documents, draft emails and answer questions. Only the information needed for the feature you use is sent to the AI provider, over encrypted connections, under the provider's business (API) terms. We do not sell your data, and we do not use your data to train our own models.

10. Service providers

We rely on a small number of service providers (sub-processors), each chosen for its security record: cloud hosting (Amazon Web Services), AI model providers, email delivery, and the procurement networks our customers connect (for example SAP Ariba). The current list is available on request.

11. Incident response

We follow a documented incident response process: detect, contain, fix, recover and learn. If a security incident affects your data, we will notify you without undue delay, and within 72 hours of confirming it, with what happened, what data was involved and what we are doing about it.

12. Compliance

• We are building our information security management system to ISO/IEC 27001 and the SOC 2 criteria, with written policies, a risk register and supplier reviews already in place.
• Independent certification is on our roadmap; this page will be updated when certificates are issued.
• Customers can request our security documentation and questionnaire answers (under NDA where needed).

13. Report a vulnerability

If you believe you have found a security issue in EzraPro, please email support@afcaitech.com with the subject "Security". Please give us reasonable time to fix it before sharing it publicly, and do not access other people's data or disrupt the service while testing. We will acknowledge your report and keep you informed.