ERP Preflight trust center
How ERP Preflight isolates tenants, keeps analysis deterministic and handles your data, for enterprise transformation teams.
Core security and privacy controls
Tenant data isolation (PostgreSQL row-level security)
EnforcedEvery tenant query runs in a transaction bound to the current organization. Row-level security in the database prevents access to other tenants’ data.
Antivirus check on upload
See statusUploaded files are scanned with ClamAV before they can be analyzed; only files marked clean are accepted as analysis input. Whether the scanner runs live on a given deployment is shown on the status page.
Deterministic rules and confidence ceiling
EnforcedAnalysis engines use deterministic ABAP/XML rules and SHA-256 evidence. AI assistance is capped at the confidence class INFERRED (0.60) and never overrides deterministic findings.
No AI training on customer data
EnforcedCustomer artifacts, code snippets and logs are never used to train AI models. Organizations can run analyses without any AI assistance.
Argon2id password hashing and token sessions
EnforcedPasswords are hashed with Argon2id. The web application authenticates API calls with a signed bearer token stored in the browser; it is removed on sign-out.
Subprocessors
| Subprocessor | Purpose | Hosting region |
|---|---|---|
| Hostinger Cloud VPS | Application hosting and compute | European Union (Frankfurt) |
| MinIO / S3-compatible storage | Artifact and report storage, separated per organization | European Union |
| Anthropic / OpenAI (optional) | Explanations and translations, only when enabled by the organization | EU / US |
Software bill of materials and container hardening
- A machine-readable SBOM is not yet published on this page. You can request it through the security contact below.
- Production web and API containers run as a dedicated non-root user (UID 1001).
Responsible vulnerability disclosure
We welcome reports from customers and independent security researchers. No paid account is required.
- Reporting channel
- security@erppreflight.com
- Response time
- Within 24–48 hours
- Safe harbor
- Good-faith research is not pursued legally
Need the security package or a custom DPA?
Request our architecture overview, data flow documentation and dependency inventory by email.