Information Security
At MerchLogix, security is foundational to how we design, operate, and deliver our solutions. We maintain a security-first mindset and employ proven, industry-standard technologies and practices to protect our systems, our customers, and their data.
Our Security Framework
Our defense-in-depth approach applies multiple layers of administrative, technical, and operational safeguards so that security does not depend on any single control. Through disciplined risk management, continuous evaluation, and responsible security practices, we strive to meet or exceed our contractual, regulatory, and industry security obligations while maintaining the trust our customers place in MerchLogix.
Our security program is organized around five core functions—Identify, Protect, Detect, Respond, and Recover—which provide a comprehensive framework for managing security risk throughout our organization. We establish clear policies, responsibilities, and oversight to govern our security practices; identify and assess risks to our systems and information; implement safeguards to protect critical assets and customer data; continuously detect and evaluate potential security events; maintain disciplined processes to respond to incidents; and ensure our ability to recover and restore operations when necessary.
Accountability, Resilience and Trust
Identify
MerchLogix combines continuous monitoring, automated security tools, and regular testing to proactively identify threats, vulnerabilities, and suspicious activity.
- Intrusion detection: Monitors systems and networks for suspicious or unauthorized activity.
- Centralized logging: Consolidates security logs to identify anomalies and support investigations.
- Static code analysis: Scans application code for vulnerabilities before deployment.
- Vulnerability management: Identifies, prioritizes, and remediates known security vulnerabilities.
- Penetration testing: Independently tests our environment to identify and address potential weaknesses.
- Risk assessment: Regularly evaluates security risks and the effectiveness of our controls.
Protect
MerchLogix uses layered security controls to protect customer data, applications, and infrastructure from unauthorized access and exposure.
- Need-based access: Limits access to systems and data based on job responsibilities and business need.
- Network segmentation: Isolates systems and environments to limit unauthorized access and reduce risk.
- Encryption: Protects sensitive data using encryption both in transit and at rest.
- Automated administration: Uses standardized automation to securely configure, maintain, and update systems.
- Security training: Provides ongoing security awareness training to help employees recognize and prevent threats.
Detect
MerchLogix continuously monitors our environment to detect suspicious activity, security events, and potential threats as quickly as possible.
- Intrusion detection: Identifies suspicious network and system activity that may indicate a potential threat.
- Automated detection: Uses automated tools and alerting to identify anomalies and potential security events.
- Centralized logging: Aggregates security-relevant logs to improve visibility and support rapid investigation.
- Security alerting: Generates and escalates alerts based on defined security events and risk thresholds.
Respond
MerchLogix maintains defined processes and capabilities to quickly contain, investigate, and respond to security incidents.
- Incident response: Follows established procedures to assess, contain, and resolve security incidents.
- Rapid escalation: Escalates security events based on severity, impact, and defined response procedures.
- Containment: Takes prompt action to isolate affected systems and limit potential impact.
- Investigation: Analyzes security events to determine scope, cause, and appropriate remediation.
- Communication: Maintains defined processes for internal escalation and required customer or stakeholder notification.
- Remediation: Corrects identified vulnerabilities and implements measures to reduce recurrence.
- Post-incident review: Reviews significant incidents to identify lessons learned and strengthen security controls.
Recover
MerchLogix maintains resilient infrastructure and recovery processes designed to restore systems and data quickly following a disruption.
- System redundancy: Maintains redundancy across application, infrastructure, and data tiers to minimize single points of failure.
- Continuous data protection: Uses continuous protection mechanisms for critical systems and data where appropriate.
- Daily backups: Performs regular backups to support reliable restoration and recovery.
- Offsite storage: Maintains backup data separately from production environments to protect against localized events.
- Recovery procedures: Maintains documented processes for restoring critical systems, applications, and data.
- Recovery testing: Periodically tests recovery capabilities to validate procedures and system readiness.
- Business continuity: Maintains continuity plans designed to sustain and restore critical operations following a disruption.
SOC2
MerchLogix is SOC 2 Type II compliant, demonstrating our commitment to maintaining effective controls and rigorous security practices over time. Our independent SOC 2 Type II audit was completed with no exceptions, providing objective assurance that the controls evaluated by our auditors were suitably designed and operated effectively throughout the audit period. This achievement reflects the strength and consistency of our security program and reinforces our commitment to protecting customer data, managing risk responsibly, and maintaining the high standards of security and operational integrity our customers expect.
ISO 27001
All MerchLogix customer applications are hosted in data centers and/or cloud providers that maintain ISO/IEC 27001 compliance, providing a strong foundation of internationally recognized information security practices for the infrastructure supporting our solutions. ISO/IEC 27001 establishes rigorous requirements for managing information security risks and maintaining effective security controls. By hosting our customer environments in facilities aligned with this standard, MerchLogix extends our defense-in-depth security approach to the underlying hosting infrastructure and helps ensure that customer applications and data are supported by a secure, resilient, and professionally managed environment.
Designed to Minimize Your Risk
As a SaaS platform, MerchLogix is designed to complement and reinforce your organization’s existing security and compliance practices—not complicate them. Our architecture minimizes data exposure, integrates with established identity and access controls, and provides the visibility and safeguards needed to support your security requirements.
- Minimal personal data: Only stores employee names and email addresses. No other personally identifiable information is collected or retained.
- SSO: Integrates with existing single sign-on providers (e.g. SAML); access follows your existing login and security policies.
- Fine-grained access control: Comprehensive role-based permissions let you control exactly who can see or do what, right down to individual stores and projects.
- Audit trail: Every change is logged for accountability and traceability, with sensitive data automatically masked to protect privacy.
- Isolation: Each customer's data lives in its own separate, dedicated environment. Customer data is never shared or mixed with other customers.
- Secure integrations: Integrations via HTTPS or SFTP; our REST API uses short-lived, secure tokens for authentication.
- Backups: MerchLogix combines real-time replication, hot-standby databases, real-time backups, and/or scheduled backups to provide a resilient data-protection and recovery architecture designed to meet each customer’s defined Recovery Time Objective (RTO) and Recovery Point Objective (RPO).