Security
So the bar is not what a marketing page claims. Below is what we actually hold, what we do not hold yet, and the controls that are true of every instance today. We would rather lose a deal here than in your procurement review.
Compliance posture
AlpineERP is a young platform. Publishing a certification we have not earned would be the single fastest way to end a deal in procurement, so this list stays honest even where it costs us.
SOC 2 Type II
Not yet heldOn the roadmap. We will publish the date we enter observation, and the report when it exists. Until then, treat any claim otherwise as wrong.
ISO 27001
Not yet heldFollows SOC 2. Our control set is being written against both frameworks now, which is not the same thing as being certified against them.
GDPR
Available todayA data processing agreement and Standard Contractual Clauses, signed before you send us any personal data.
Penetration testing
Not yet commissionedNo independent test has been run against the platform. When one has, the summary will be published here with its date.
Controls
TLS in transit and disk-level encryption at rest, on infrastructure operated by a major cloud provider rather than hardware of our own.
Role-based and row-level permissions, two-factor authentication, and single sign-on via OIDC. SCIM provisioning is not available yet.
You choose the region at signup and we name the provider and location in writing. Data stays there unless you configure an integration that sends it elsewhere.
Daily encrypted backups on every plan. Point-in-time recovery is a paid tier, not a default — we would rather say which you have than imply everyone gets it.
Every write is recorded against the record it changed and attributed to the person who made it. Read access is not logged today.
A separate database per customer, with no shared query path where a filter mistake could cross a boundary.
Disclosure
We welcome coordinated disclosure and we do not threaten researchers. Email security@alpineerp.com before you begin testing, and we will acknowledge within one business day.
Open-source components and their licences are listed on our licensing page.
