Your documents are your business.
We protect them that way.
Purchase orders, invoices and ship notices carry prices, customers and volumes. Here is how we keep them, and the accounts that reach them, secure.
Encrypted connections
The portals are served only over HTTPS. Documents move between systems over SFTP, AS2 or HTTPS APIs, all of which encrypt data in transit.
Each company sees only its own data
Every portal query is limited to the signed-in company. A client never sees another client's documents, and a trading partner never sees another partner's.
Separate portals, separate sign-ins
The Admin, Client and Trading Partner portals each have their own accounts and sessions. Signing in to one never grants access to another.
Strong sign-in protection
Passwords are stored only as salted hashes. Accounts lock after repeated failed sign-ins, and idle sessions end automatically after 30 minutes.
Protected against forged actions
Every action that changes data is checked with a one-time token, so another website cannot trick your browser into approving, sending or deleting a document.
Credentials kept out of reach
Database, email and partner connection credentials are stored outside the web application and its source code, and are never shown in the portals.
Everything is logged
Sign-in attempts, document transmissions and administrative changes are logged with time and source, so every action can be traced.
Test kept apart from production
Every trading relationship has separate test and production settings, so trial documents never reach a live system.
Reviewed and re-checked
Our servers block access to internal files and hide software versions. We re-check these protections on every deployment.
Reporting a security issue
If you believe you have found a security vulnerability, please email Support@ediconnections.com with "Security report" in the subject. Include enough detail for us to reproduce it. We will acknowledge your report, keep you updated while we investigate, and ask that you give us reasonable time to fix the issue before sharing it publicly.
Please do not access, change or delete data that isn't yours, and do not run tests that could disrupt the service for other customers.
Questions from your security team
Working through a vendor security questionnaire? Contact us and we'll go through it with you.