Security Overview

Revision Date: August 26, 2026

Trust Page & Subprocessor list

Platform Security

Encryption

Customer data is encrypted in transit and at rest.

Data Retention

Customer data is retained and disposed of in accordance with Procurify’s Data Retention and Disposal Policy.

Backups & Recovery

Databases are backed up on a regular schedule and backups are periodically tested. Backup systems protect the confidentiality, integrity, and availability of stored data.

Secure Development

Changes to the platform follow a documented development lifecycle that includes peer code review, automated testing, and vulnerability scanning before release.

Business Continuity & Disaster Recovery

Essential data is stored with commercial cloud providers using backup and redundancy processes designed to minimize disruption. Our business continuity and disaster recovery plan is reviewed and tested regularly.

Incident Response

Procurify’s incident response process covers detection, containment, and communication. Notification to affected customers follows our Data Processing Addendum.

Vulnerability Management

Vulnerability management is integrated into our Change Management Process. Identified vulnerabilities are prioritized by severity and tracked through to remediation.

Organizational Security

Access Control

Access to internal systems is granted on the principle of least privilege based on business needs, job roles, and functions.

Authentication

Internal system access is protected by password requirements and multi-factor authentication.

Device Management

Procurify requires company-managed devices for handling customer information. Devices are centrally managed, with full-disk encryption enforced and endpoint protection installed.

Security Awareness Training

All team members complete security awareness training at onboarding and on a recurring basis thereafter.

Governance, Risk, and Compliance

Security Policies

Procurify maintains a set of information security policies that define responsibilities for protecting our systems and meeting our service commitments. Policies are reviewed and updated regularly, and team members are required to acknowledge them.

Risk Management

Procurify maintains a risk management program supported by a risk register that identifies risks, assigns ownership, and tracks treatment plans.

Vendor Risk Management

Procurify’s Vendor Management Policy governs third-party agreements, with due diligence performed prior to contract execution and on an annual basis thereafter. Our current subprocessor list is published at trust.procurify.com.

Third-Party Penetration Testing

Procurify engages an independent third party to perform application penetration testing of the production environment at least annually. Findings are prioritized and tracked through to remediation.

Compliance

Procurify is SOC 1 Type 2 and SOC 2 Type 2 audited, and supports GDPR and CCPA compliance. Reports and additional detail are available at trust.procurify.com.

Artificial Intelligence

Procurify’s AI features and the terms that govern them are set out in our Privacy Policy, Data Processing Addendum, and Software Subscription Agreement.

Responsible Disclosure

If you have any questions, comments, or concerns, or if you wish to report a potential security issue, please contact [email protected]

For additional information, check out our Trust Page

Trust Page & Subprocessor list