Security Standards | ProcureLabs®

At ProcureLabs, security is fundamental to our platform. We implement industry-leading security measures to protect your procurement data and ensure compliance with global standards.

Certifications Compliance

SOC 2 Type II

Security, availability, and confidentiality controls aligned with SOC 2 framework.

Planned

GDPR

Privacy controls aligned with EU General Data Protection Regulation requirements.

Planned

Data Encryption

Encryption in Transit

All data transmitted to and from ProcureLabs is encrypted using TLS 1.3 with AES-256-GCM cipher suites. We enforce HTTPS for all connections.

Encryption at Rest

All stored data is encrypted using AES-256 encryption. Database backups are encrypted and stored in geographically distributed locations.

Key Management

Encryption keys are managed through our cloud provider's key management service with automatic rotation and strict access controls.

Infrastructure Security

Cloud Infrastructure: Hosted on AWS, which holds SOC 2, ISO 27001 and PCI DSS certifications. These are AWS's certifications, not ProcureLabs'.
Network Security: Web Application Firewall (WAF), DDoS protection, and intrusion detection systems
Data Isolation: Row-level security is enabled on all 2,042 tables in the database, enforced by 3,699 policies, with none disabled. Isolation is a property of the data layer, not of application code that a bug can route around: a query that omits the tenant returns nothing rather than another customer’s rows. Verified against production on 30 August 2026.
Availability: Automatic failover and geographic redundancy
Disaster Recovery: Automated backups with point-in-time recovery and documented disaster recovery procedures

Access Control

Authentication

Multi-factor authentication (MFA) support
SSO integration via SAML 2.0 and OIDC
Strong password policies with complexity requirements
Session management with automatic timeout

Authorization

Role-based access control (RBAC)
Granular permissions at feature and data level
Principle of least privilege enforced
Audit logging of all access events

Employee Access

Background checks for all employees
Mandatory security training
Access only on need-to-know basis
All access logged and regularly reviewed

Security Monitoring & Response

24/7 Monitoring: Continuous security monitoring with automated alerting for suspicious activities
Vulnerability Management: Regular vulnerability scanning
Incident Response: Documented incident response procedures with dedicated security team
Security issues can be reported to our security contact below.

AI Data Processing Security

Our AI features are designed with security and privacy in mind:

AI models do not retain or learn from your specific data
Data sent to AI services is encrypted and not stored after processing
Optional AI features can be disabled by administrators
Clear consent mechanisms for AI-assisted features
Audit logs for all AI interactions

Data Residency

All customer data is stored and processed in a single region. Additional regions are not available today.

Asia Pacific

Singapore (AWS ap-southeast-1)

Security Contact

For security concerns, vulnerability reports, or compliance inquiries:

Security Team: support@procure-labs.com

PGP Key: Available upon request for encrypted communications

Data Encryption

Encryption in Transit

All data transmitted to and from ProcureLabs is encrypted using TLS 1.3 with AES-256-GCM cipher suites. We enforce HTTPS for all connections.

Encryption at Rest

All stored data is encrypted using AES-256 encryption. Database backups are encrypted and stored in geographically distributed locations.

Key Management

Encryption keys are managed through our cloud provider's key management service with automatic rotation and strict access controls.

Infrastructure Security

Cloud Infrastructure: Hosted on AWS, which holds SOC 2, ISO 27001 and PCI DSS certifications. These are AWS's certifications, not ProcureLabs'.

Network Security: Web Application Firewall (WAF), DDoS protection, and intrusion detection systems

Data Isolation: Row-level security is enabled on all 2,042 tables in the database, enforced by 3,699 policies, with none disabled. Isolation is a property of the data layer, not of application code that a bug can route around: a query that omits the tenant returns nothing rather than another customer’s rows. Verified against production on 30 August 2026.

Availability: Automatic failover and geographic redundancy

Disaster Recovery: Automated backups with point-in-time recovery and documented disaster recovery procedures

Access Control

Authentication

Multi-factor authentication (MFA) support
SSO integration via SAML 2.0 and OIDC
Strong password policies with complexity requirements
Session management with automatic timeout

Authorization

Role-based access control (RBAC)
Granular permissions at feature and data level
Principle of least privilege enforced
Audit logging of all access events

Employee Access

Background checks for all employees
Mandatory security training
Access only on need-to-know basis
All access logged and regularly reviewed

Security Monitoring & Response

24/7 Monitoring: Continuous security monitoring with automated alerting for suspicious activities

Vulnerability Management: Regular vulnerability scanning

Incident Response: Documented incident response procedures with dedicated security team

Security issues can be reported to our security contact below.

AI Data Processing Security

Our AI features are designed with security and privacy in mind:

AI models do not retain or learn from your specific data

Data sent to AI services is encrypted and not stored after processing

Optional AI features can be disabled by administrators

Clear consent mechanisms for AI-assisted features

Audit logs for all AI interactions