Security and compliance
Enterprise integration supported by security-focused infrastructure
ECOM offers integration and hosting environments designed to support demanding enterprise security, privacy and regulatory requirements, with applicable independent assurance and compliance controls. Security configurations are selected according to the integration architecture, applicable requirements and customer agreements.
Request security documentationIntegration security
Secure integration built around your business requirements
These are the areas ECOM addresses in integration design and operations. Which controls apply depends on the product, the environment and your agreement.
Encryption in transit
Encrypted protocols such as AS2, SFTP, FTPS and HTTPS protect data moving between partners and systems.
Secure file transfer
Partner file exchange over secured, monitored connections, with the protocol each partner requires.
Authentication and authorization
Partners, users and systems are identified with credentials, certificates or keys, and given only the access they need.
Partner-specific security
Each partner's required protocol, encryption and authentication settings are configured and documented for that partner.
Secure API communication
APIs are exposed over encrypted connections with authentication and authorization on each call.
Audit trails and monitoring
Integration activity and access are recorded and monitored according to the environment and agreement.
Independent assurance
Compliance and assurance frameworks
These frameworks are relevant to ECOM's hosting and operating environments. Each applies to a defined scope, so ECOM confirms what covers the services you are evaluating.
-
SOC 2 Type II
An independent auditor's report on how well a service organization's controls are designed and how effectively they operate over a period of time, against the AICPA Trust Services Criteria. It is an examination report, not a certification, and it covers the specific criteria and system it names.
At ECOM: The environments, Trust Services Criteria and period covered are confirmed for the services you are evaluating.
-
HIPAA Security Rule safeguards
The HIPAA Security Rule requires administrative, physical and technical safeguards for electronic protected health information (ePHI). There is no official general-purpose HIPAA certification; organizations apply the safeguards and sign business associate agreements where required.
At ECOM: Which environments are suitable for ePHI, and the agreements that apply, are confirmed before any ePHI is exchanged.
-
PCI DSS
The Payment Card Industry Data Security Standard applies to systems that store, process or transmit payment card data. Compliance is validated for a defined scope, at a stated level and version of the standard.
At ECOM: PCI DSS applies only to the systems and services covered by current validation evidence; other services are outside that scope.
-
SSAE 18 and ISAE 3402
SSAE 18 (AICPA) and ISAE 3402 (IAASB) are the attestation standards under which service organization control reports are issued. SSAE 18 superseded SSAE 16, sometimes written SSA 16, in 2017. The standard is not the report: what matters is which report was issued and what it covers.
At ECOM: The reports issued under these standards, their scope and their periods are confirmed for the services you are evaluating.
Scope
Not every environment is the same
ECOM's services run in different environments: some operated by ECOM, some hosted in third-party data centers and some in customers' own environments. Assurance reports and compliance validations each cover a defined scope, so the right question is always which controls and reports apply to the services you use.
- ECOM-operated environments
- Third-party data centers, with their own assurance reports
- Customer-hosted and hybrid deployments
Frequently asked questions
Is ECOM HIPAA certified?
There is no official general-purpose HIPAA certification. Organizations that handle ePHI apply the HIPAA Security Rule safeguards and sign business associate agreements where required. ECOM confirms which environments are suitable for ePHI before any is exchanged.
Is SOC 2 a certification?
No. A SOC 2 Type II report is an independent examination of controls over a period of time. It names the system and the Trust Services Criteria it covers, and those details matter more than the label.
Are all ECOM services covered by the same assurance?
No. Different services and environments can have different scope, including environments operated by ECOM and those hosted in third-party data centers. ECOM confirms what applies to the services you are evaluating.
How do I get security documentation?
Ask ECOM for the security and compliance documentation that applies to the services you are evaluating. Reports and detailed controls are shared under confidentiality terms.
Request security documentation
Tell us which services you are evaluating and your security requirements. ECOM will share the documentation that applies.