Security & Data Handling

#Certification status, stated plainly

ISO 27001 alignment is in progress. SOC 2 Type II is on the roadmap and not yet held. We publish this rather than displaying badges we have not earned, because the first thing a competent reviewer does is ask which legal entity is certified and what the audit scope covers — and a logo answers neither.

Ask us both of those questions. Ask them of every provider you shortlist.

#Access

• Access is granted by you, to named individuals, at the least privilege the work requires.
• It is revoked through your own joiner-leaver process, so you are never dependent on us telling you someone has left.
• We work inside your systems rather than extracting data into ours. Where a copy is genuinely unavoidable, its location and retention are agreed in writing before it is made.
• Access is reviewed at each monthly service review, and dormant accounts are surrendered rather than retained in case they are useful later.

#What we cannot do

Some controls matter more than any certificate, because they remove the possibility rather than reducing the likelihood.

• No one on our side can release a payment or authorise a payment run.
• A change to a supplier's bank details is always treated as an exception, escalated to your nominated contact for out-of-band verification, and never actioned by us.
• The analyst who maintains supplier master data is never the analyst who processes that supplier's invoices.
• Approval authority stays exactly where your delegation of authority puts it. We prepare and route; you approve and release.

#People

• Background verification before an analyst is assigned to a client account.
• Confidentiality obligations in every employment contract, surviving termination.
• Named analysts and named backup cover per account, so you always know who has access.
• Annual security awareness training, with role-specific training for anyone handling supplier bank data.

#Where your data sits

Delivery is from India and the United Arab Emirates and we say so on every page rather than burying it. Because we work inside your systems, your data generally stays in whatever region you already keep it.

Where a transfer needs a safeguard we use the UK International Data Transfer Agreement or the EU standard contractual clauses. Where you require data residency in a particular region, we agree it in the Data Processing Addendum before access is granted.

#Incidents

If we become aware of a security incident affecting your data we tell you without undue delay and in any event within 24 hours, with what we know at the time. We would rather give you a partial picture early than a complete one late.

#Reporting a vulnerability

If you believe you have found a security issue in this website or in how we handle data, email legal@procuriva.com with the detail. We will acknowledge within two working days. We will not pursue anyone who reports a genuine issue in good faith and gives us a reasonable chance to fix it before disclosing it.