# PurchasePlus Trust Center > Review the PurchasePlus Terms and Conditions. Understand the legal agreement governing your use of our website and procurement software services. Source: /trust-center PurchasePlus Trust Center # Security is not a feature. It is a Strategic Imperative. In the modern hospitality landscape, a procurement platform is a critical repository of financial intelligence. We move beyond simple service delivery to a model of holistic trust, secured by ISO 27001 and SOC 2 Type 2. ## The Framework of Assurance PurchasePlus adopts a dual-framework approach. While ISO 27001 validates our management system design, SOC 2 Type 2 proves our operational effectiveness over time. ISO 27001: Governance SOC 2 Type 2: Performance ### ISO 27001: The Governance Foundation A prescriptive framework focusing on the Information Security Management System (ISMS). It ensures security is a proactive organizational culture, not just a reactive technical layer. * Continuous internal & external audits * Risk-based approach to unique threats * Covers physical security to employee training * Global standard for international proof ### SOC 2 Type 2: Proof of Performance Validates the execution of controls over a lookback period (6–12 months). It assures that controls are actually operating effectively, not just designed correctly. * Evaluates Operational Effectiveness * Focuses on 5 Trust Services Criteria * Critical for 'exception-based' auditing * Assures availability for 24/7 ops ### SOC 2 Trust Services Criteria Select a slice to explore how we meet each criterion. #### Privacy Personal data is handled according to privacy notices. Enterprise Impact Ensures compliance with GDPR, APP, and other privacy laws. #### Processing Integrity Transaction processing is complete, precise, and authorized. Enterprise Impact Guarantees accuracy in automated AP and live GP% data. #### Security Protection of the system against unauthorized access. Enterprise Impact Prevents data breaches and financial fraud. #### Availability System is ready for use and functioning as agreed. Enterprise Impact Ensures 24/7 procurement operations and uptime. #### Confidentiality Sensitive data (e.g., contract rates) is protected. Enterprise Impact Safeguards competitive advantage for hotels and suppliers. ## Technical Architecture: Defense-in-Depth Our cloud-native procurement lifecycle is secured by a multi-layered strategy. We assume no trust, even inside the perimeter. 👤 Identity Layer (IAM) Zero Trust, MFA, SSO, RBAC 🔒 Data Protection Layer Encryption (TLS 1.3, AES-256), Logical Separation ☁️ Infrastructure Layer AWS/Azure IaaS, DDOS Protection, Redundancy ### Identity & Access Management (IAM) The new perimeter. We rely on 'Never trust, always verify'. #### MFA Multi-Factor Authentication prevents 81% of credential breaches. #### SSO SAML 2.0/OIDC integration (Okta, Azure AD) for centralized control. #### RBAC Principle of Least Privilege limits 'blast radius' of compromised accounts. ### Data Protection Layer Defense-in-depth for the hospitality ecosystem's most valuable asset. #### Encryption in Transit TLS 1.2/1.3 protects pricing and bank details on the wire. #### Encryption at Rest AES-256 ensures data remains unreadable even if storage is breached. #### Logical Separation Multi-tenant architecture ensures strict isolation of hotel group data. ### Infrastructure & Cloud Built on security-hardened global providers (AWS/Azure). #### Redundancy Distributed across multiple Availability Zones for high availability. #### Automated Failover Real-time rerouting restores services without manual intervention. #### Physical Security Leveraging Tier-4 data center protections of IaaS partners. ## Operational Resilience & Continuity In hospitality, downtime means stockouts. We target 99.99% availability. Our Incident Response Plan (IRP) is tested annually to ensure we can restore operations swiftly. 1 Preparation 2 Detection 3 Containment 4 Eradication 5 Recovery ### Preparation Phase Developing playbooks, training CSIRT, tabletop exercises. ### Detection Phase Monitoring system logs/alerts to identify scope/severity. ### Containment Phase Isolating affected systems to block malicious traffic. ### Eradication Phase Removing malware, patching vulnerabilities, restoring roots. ### Recovery Phase Verifying integrity and returning to normal operations. ## Global Privacy Compliance * ### Data Minimization Collecting only essential business contact details. No unnecessary PII. * #### Cross-Border Transfers Protected by Standard Contractual Clauses (SCCs) and adequacy decisions. * #### Guest Data Protection Special order data and guest PII processed with financial-grade security. ### Security as Business Enabler #### Accelerated Time-to-Value ISO/SOC 2 certifications act as a "security passport", bypassing months of IT audits. #### Spend Control & Fraud Prevention Automated 3-way matching and rigid audit trails prevent maverick spend and invoice fraud. #### AI Readiness A clean, secure data foundation is the prerequisite for next-gen AI spend analytics (ISO 42001 alignment). ### PurchasePlus Trust Center Setting the new standard for enterprise hospitality partnership through holistic trust and partnership. #### Compliance Artifacts * [ISO 27001 Certificate](javascript:void\(0\)) * [SOC 2 Type 2 Summary](javascript:void\(0\)) * [Privacy Policy](/privacy-policy) #### Trust Center * [System Status](https://purchaseplus-status.com/) * [Vulnerability Disclosure (VDP)](javascript:void\(0\)) * [Contact Security Team](javascript:void\(0\)) ### Request security & compliance documentation Use this form to contact our security and compliance team to request documentation or report security issues. Submissions are sent directly to our security team. We typically respond within 2 business days. Close form