PurchasePlus Trust Center

Security is not a feature.
It is a Strategic Imperative.

In the modern hospitality landscape, a procurement platform is a critical repository of financial intelligence. We move beyond simple service delivery to a model of holistic trust, secured by ISO 27001 and SOC 2 Type 2.

The Framework of Assurance

PurchasePlus adopts a dual-framework approach. While ISO 27001 validates our management system design, SOC 2 Type 2 proves our operational effectiveness over time.

ISO 27001: The Governance Foundation

A prescriptive framework focusing on the Information Security Management System (ISMS). It ensures security is a proactive organizational culture, not just a reactive technical layer.

  • Continuous internal & external audits
  • Risk-based approach to unique threats
  • Covers physical security to employee training
  • Global standard for international proof

SOC 2 Type 2: Proof of Performance

Validates the execution of controls over a lookback period (6–12 months). It assures that controls are actually operating effectively, not just designed correctly.

  • Evaluates Operational Effectiveness
  • Focuses on 5 Trust Services Criteria
  • Critical for 'exception-based' auditing
  • Assures availability for 24/7 ops

SOC 2 Trust Services Criteria

Select a slice to explore how we meet each criterion.

Privacy

Personal data is handled according to privacy notices.

Enterprise Impact

Ensures compliance with GDPR, APP, and other privacy laws.

Processing Integrity

Transaction processing is complete, precise, and authorized.

Enterprise Impact

Guarantees accuracy in automated AP and live GP% data.

Security

Protection of the system against unauthorized access.

Enterprise Impact

Prevents data breaches and financial fraud.

Availability

System is ready for use and functioning as agreed.

Enterprise Impact

Ensures 24/7 procurement operations and uptime.

Confidentiality

Sensitive data (e.g., contract rates) is protected.

Enterprise Impact

Safeguards competitive advantage for hotels and suppliers.

Technical Architecture: Defense-in-Depth

Our cloud-native procurement lifecycle is secured by a multi-layered strategy. We assume no trust, even inside the perimeter.

Identity & Access Management (IAM)

The new perimeter. We rely on 'Never trust, always verify'.

MFA

Multi-Factor Authentication prevents 81% of credential breaches.

SSO

SAML 2.0/OIDC integration (Okta, Azure AD) for centralized control.

RBAC

Principle of Least Privilege limits 'blast radius' of compromised accounts.

Data Protection Layer

Defense-in-depth for the hospitality ecosystem's most valuable asset.

Encryption in Transit

TLS 1.2/1.3 protects pricing and bank details on the wire.

Encryption at Rest

AES-256 ensures data remains unreadable even if storage is breached.

Logical Separation

Multi-tenant architecture ensures strict isolation of hotel group data.

Infrastructure & Cloud

Built on security-hardened global providers (AWS/Azure).

Redundancy

Distributed across multiple Availability Zones for high availability.

Automated Failover

Real-time rerouting restores services without manual intervention.

Physical Security

Leveraging Tier-4 data center protections of IaaS partners.

Operational Resilience & Continuity

In hospitality, downtime means stockouts. We target 99.99% availability. Our Incident Response Plan (IRP) is tested annually to ensure we can restore operations swiftly.

Preparation Phase

Developing playbooks, training CSIRT, tabletop exercises.

Detection Phase

Monitoring system logs/alerts to identify scope/severity.

Containment Phase

Isolating affected systems to block malicious traffic.

Eradication Phase

Removing malware, patching vulnerabilities, restoring roots.

Recovery Phase

Verifying integrity and returning to normal operations.

Global Privacy Compliance

  • Data Minimization

    Collecting only essential business contact details. No unnecessary PII.

  • Cross-Border Transfers

    Protected by Standard Contractual Clauses (SCCs) and adequacy decisions.

  • Guest Data Protection

    Special order data and guest PII processed with financial-grade security.

Security as Business Enabler

Accelerated Time-to-Value

ISO/SOC 2 certifications act as a "security passport", bypassing months of IT audits.

Spend Control & Fraud Prevention

Automated 3-way matching and rigid audit trails prevent maverick spend and invoice fraud.

AI Readiness

A clean, secure data foundation is the prerequisite for next-gen AI spend analytics (ISO 42001 alignment).

PurchasePlus Trust Center

Setting the new standard for enterprise hospitality partnership through holistic trust and partnership.

Compliance Artifacts

Trust Center

Request security & compliance documentation

Use this form to contact our security and compliance team to request documentation or report security issues.

Submissions are sent directly to our security team. We typically respond within 2 business days.