Your own instance
A client-dedicated instance, isolated from every other tenant, is available on the Professional and Enterprise plans.
Security & compliance
Your data, your instance, under your control
IRISYS holds your sales, stock and supplier data. This page explains where it lives, who can reach it, how it is backed up, and what we commit to contractually. Ask us for the full security documentation before your pilot.
Six commitments
One database per client
Each client has its own database and its own encryption keys for stored credentials. There is no shared table between clients.
Access under your control
Roles (Admin, Planner, Manager, Executive) with scopes by brand, category and store, multi-factor authentication, and single sign-on with your identity provider.
Everything is logged
Every forecast override, order validation, transmission, transfer and user change is written to an audit log with who, what and when. The log is exportable.
Backed up daily
Encrypted daily backups retained for 30 days, stored in a second EU location, with restoration tested on a schedule.
Your data stays yours
Export everything in CSV at any time. At contract end your data is returned and deleted from production and backups within 30 days.
Controls in detail
| Area | What IRISYS does |
|---|---|
| Encryption in transit | All traffic to IRISYS and to the API uses TLS 1.2 or higher. ERP connections use HTTPS, SFTP or a VPN tunnel; plain FTP is never used. |
| Encryption at rest | Databases, file storage and backups are encrypted at rest. ERP credentials are encrypted at application level with a per-client key. |
| Authentication | Passwords hashed with a modern algorithm, MFA available for every user and enforceable per role, SSO (SAML / OpenID Connect), session expiry and login rate limiting. |
| Authorisation | Role-based access with scopes by brand, category and store. Approval thresholds decide which orders need a human validation. |
| ERP integration | IRISYS reads items, stock, sales and suppliers, and writes only purchase orders and transfer orders, each carrying the IRISYS reference. The ERP account used by IRISYS is created by you with the minimum rights needed. |
| Monitoring | Infrastructure and application monitoring with alerts to the IRISYS on-call engineer. Failed ERP transmissions raise alerts to the planner and the administrator. |
| Backups and recovery | Daily encrypted backups, 30-day retention, copy in a second EU location. Recovery objectives are written into the contract. |
| Software supply chain | Dependencies are updated on a regular cycle and scanned for known vulnerabilities before each release. |
| Vulnerability disclosure | Report a vulnerability to security@irisys.cloud. We acknowledge within two business days and keep you informed until it is fixed. |
Data protection and compliance
UAE PDPL and GDPR
IRISYS processes your data under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, for European clients, the GDPR. A data processing agreement is signed with every contract.
What we process
Item, stock, sales and supplier data from your ERP, and the accounts of your users (name, work email, role). IRISYS does not need your customers' personal data; sales are processed at store and SKU level.
Sub-processors
The infrastructure provider and the email provider used for notifications. The full list is in the data processing agreement and updated with 30 days' notice.
Certifications and audits
[À COMPLÉTER] Third-party audits and certifications will be listed here as they are completed. Our security documentation and questionnaire answers are available under NDA.
Business continuity
Documented incident response and continuity plans. Clients are informed of a security incident affecting their data without undue delay, and within 72 hours at the latest.
Security questions we are asked
IRISYS is delivered as a managed service, with a client-dedicated instance available. On-premise deployment is not offered; it would remove the monitoring and update guarantees described on this page.
Read access to items, stock, sales and suppliers, and write access limited to purchase orders and transfer orders. You create the account and can revoke it at any time.
Only the engineers assigned to your account, for support and maintenance, under a confidentiality agreement. Every access is logged and available to you on request.
Yes. Architecture, controls, backup and incident procedures and our answers to standard security questionnaires are shared under NDA before the pilot.
Need our security documentation?
Architecture, controls, backup and incident procedures, and answers to standard questionnaires, shared under NDA before your pilot.