At Salesupply, we are dedicated to safeguarding your data with robust security and privacy measures. This policy outlines our comprehensive approach to protecting the information entrusted to us. Last updated: 9 November 2026.
This text is available in several languages. If the versions differ, the English version prevails.
This section outlines the foundational policies, governance, and certifications that form the backbone of our Information Security Management System (ISMS).
We have a clearly documented Information Security Policy, first approved by our Management Board on 8 January 2021. This policy is distributed through an online system, is mandatory for all Salesupply staff and is reviewed annually. Our Data Processing Agreements (DPAs) with customers and sub-processors further define our data protection and privacy commitments.
Our Information Security Policy states that identified risks are subject to a risk assessment, and the risk assessment and treatment plan are developed based on ISO 27005 guidelines.
The Management Board is responsible for the Information Security Policy. The Information Security Manager (CTO) is responsible for maintaining and coordinating the Information Security Management System (ISMS).
Our servers are hosted in ISO 27001 certified data centers, with certified physical and environmental security.
Our people and processes are fundamental to our security. Here we detail the organizational controls we have in place to protect your data throughout its lifecycle.
Background checks are performed on new employees, including obtaining professional references. All employees sign employment contracts that include confidentiality clauses and an Information Security Policy acknowledgement. All staff are responsible for protecting information and reporting security incidents. Non-Disclosure Agreements (NDAs) are used with our partners.
Our Data Processing Agreements include audit rights for the Controller (our customer) to verify compliance, with reasonable notice and at no additional cost as per the agreement.
All information assets are registered and have assigned owners. Secure disposal of media is conducted according to documented procedures to prevent data leakage from retired assets.
Our Information Security Policy details incident management, including reporting channels, investigation, and communication to affected parties. Our Data Processing Agreements require Salesupply to notify the Controller without undue delay after becoming aware of a personal data breach.
Our Data Processing Agreements emphasize the requirement for Salesupply to ensure sub-processors comply with data protection regulations and to inform the controller about intended changes regarding sub-processors. The Information Security Policy states that “Suppliers who process information assets of Salesupply or its clients must comply with the requirements of this policy”.
A Business Continuity Plan (BCP) is in place to minimize disruption of services in case of unexpected events, ensuring resilience and availability of our services.
We employ a multi-layered technical approach to protect our systems and your data from threats. Below are the key technical controls we have implemented.
Full disk encryption (BitLocker) is implemented on all laptops using a minimum of AES-256. All removable media are disabled. The use of private mobile devices for company purposes is not allowed. Regular users do not have local administrator rights.
Salesupply offices have security systems, alarm systems, video surveillance, and access control through key cards. Our ISO 27001 certified data centers feature physical access controls, surveillance, and alarms.
Firewalls control network traffic and block unauthorized access. Separation of development, test, and production environments. Wireless networks secured using WPA2-Enterprise and Network Access Control (NAC).
Advanced malware protection (antivirus, anti-spyware) is installed on all servers and endpoints and is kept continuously up-to-date.
Secure remote access (VPN) with multi-factor authentication (MFA). Restricted and monitored access to administrative interfaces. Encrypted data transfer methods (VPN, SSL/TLS, SFTP) for all data exchange.
Intrusion detection and prevention systems (IDS/IPS) are implemented to monitor network traffic for malicious activity and policy violations.
Systems are configured in accordance with industry best practices and security baselines (e.g., CIS Benchmarks, NIST) to reduce their attack surface.
System logs and audit trails are maintained for critical systems. Logging of personal data is minimized. Logs are reviewed regularly to detect security incidents and unusual activities.
Regular backups of critical data are performed, and their integrity is tested. Redundancy for critical systems is implemented to ensure high availability.
Found a vulnerability in one of our systems, or have a question about the security of your data? Email security@salesupply.com. Customers can also contact their Salesupply account manager, for example for a completed security questionnaire.
Published 26 October 2026 · Status: resolved
On 21 October 2026, two critical security vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) were made public, with European and international security agencies urging organizations to patch immediately. This is how Salesupply handled it.
In short: we acted the same morning, before the official fix was available. All of our PHP systems were patched within days, most of them within hours of the fix being released. Order, stock and shipment flows kept running throughout. We found no signs of unauthorized access, and no customer data was lost or exposed.
PHP is the programming language behind a large share of the world's websites and web applications, including several Salesupply systems. The two flaws, both rated critical (CVSS 9.2), could allow an attacker to take over a server remotely without logging in. Because the weakness sat in PHP itself rather than in any company's own software, it affected organizations worldwide.
On the morning of 21 October, before the official fix was published, our Business Technology team mapped every system running PHP and assessed its exposure. On all of them we switched off the PHP feature the attacks were expected to target, following the vendor's recommended mitigation. As an extra precaution we temporarily paused file uploads to our PHP systems, and took systems offline where that was the safer choice.
The official PHP fix was released at 16:00 CEST that afternoon. By the same evening our customer-facing systems were running on patched PHP versions. The last remaining system stayed protected by the mitigation and was fully patched on 23 October during a short maintenance window.
Order import, stock synchronization, shipment and tracking updates, logins, dashboards and reporting all continued as normal. The patches required only a short restart. The one temporary limitation was file uploads, such as bulk imports through the dashboard, which we paused until the fixes were confirmed. Uploads have since been fully restored.
Yes. After patching, we checked all PHP systems for signs of misuse, such as unexpected files, processes or connections, and kept monitoring them in the days that followed. We found no indication that any system was accessed by an attacker, and no customer data was lost, altered or exposed. No action is required on your side.
We are speeding up work that was already planned, so that every system we run is on a supported version that receives security fixes directly from the vendor. We keep monitoring security advisories closely so we can respond the same day, as we did here.