Security Overview

Cloud Infrastructure

Suite Enrich AI runs on Oracle Cloud Infrastructure (OCI) in the us-phoenix-1 region. OCI provides enterprise-grade physical security, redundant power, and network infrastructure with ISO 27001 and SOC 2 certifications at the infrastructure layer.

Data Encryption

• All data in transit encrypted with TLS 1.2 or higher
• All data at rest encrypted with AES-256
• API keys are hashed using industry-standard algorithms — no plaintext credentials stored anywhere in our systems

Network Security

• Network Security Groups (NSGs) controlling all inbound and outbound traffic
• Private endpoints for database connectivity
• API Gateway with authentication enforcement on all endpoints
• No public database exposure

Tenant Isolation

Every customer's data is scoped by tenant ID throughout the entire platform stack. Customer data cannot be accessed by other customers. API key validation enforces tenant boundaries on every request. Cross-tenant data access is architecturally prevented.

Access Controls

• Role-based access control (RBAC) for all internal systems
• Least-privilege access principles enforced
• Multi-factor authentication required for all internal administrative access
• Access reviews conducted regularly

Authentication and API Security

• All API requests validated against hashed API keys
• Rate limiting and throttling on all API endpoints
• Idempotency controls to prevent duplicate processing
• Request logging for audit and forensic purposes

Audit Logging and Monitoring

• Comprehensive audit logging of all API requests and data access events
• Usage and authentication event logging per tenant
• Logs retained for up to 12 months for security and forensic purposes
• Anomaly monitoring for unusual usage patterns

Stateless Architecture

Suite Enrich uses stateless serverless functions (Oracle Cloud Functions) for enrichment processing. Customer-submitted data is processed transiently and not stored long-term in Suite Enrich's systems. Enriched data is returned directly to the customer's NetSuite environment.

Data Minimization

Suite Enrich does not store enrichment results long-term. Customer-submitted data is processed and returned to the customer's ERP. We retain only the data necessary to provide the service (usage logs, billing records, API key hashes).

Data Retention and Deletion

• Customer account data retained for duration of service plus 90 days post-termination
• Usage and billing data retained for 7 years per financial record requirements
• Technical logs retained for up to 12 months
• Certified deletion available upon written request after contract termination

Foreign Adversary Restriction

Suite Enrich does not transfer customer data or enrichment data to any entity in or owned or controlled by a Foreign Adversary Country as designated under the Protecting Americans' Data From Foreign Adversaries Act (PADFAA), including China, Russia, Iran, and North Korea.

Sub-processor Oversight

All sub-processors (cloud infrastructure, payment processing, AI providers) are bound by contractual data protection obligations consistent with our DPA. A current sub-processor list is available upon written request to support@suiteenrich.com.