SPS Trust Center
SPS Commerce moves order, inventory, and shipment data for thousands of companies, every day, across a network built on 300,000+ trading relationships. Security sits at the foundation of that network, not on top of it. Confidentiality of your data, integrity of every transaction, and uptime of the platform are protected under the same controls, without exception, for every partner on the network.
Our infrastructure runs on AWS with encryption at rest and in transit, active intrusion detection, and disaster recovery built into the architecture. We hold ISO/IEC 27001, SOC 1 Type 2, and SOC 2 Type 2 certifications, and run independent penetration testing on a regular cadence. A dedicated security team owns this work full-time, backed by a secure development lifecycle and continuous employee training. We're also RH-ISAC members and carry cyber insurance.
For any security-related inquiries, please reach out to us at security@spscommerce.com.
- How does SPS ensure responsible use of AI?
- Does SPS have AI governance?
- Does SPS monitor its AI systems?
- Does SPS have data handling standards related to AI products and tools?
- Does SPS have security testing performed on its AI systems?
SPS Trust Center Updates
PHP Vulnerabilities — SPS Commerce Response (October 2026)
On October 21, the PHP project disclosed two critical security vulnerabilities in software used widely across the industry and released fixes. SPS Commerce acted quickly and we have not seen evidence of exploitation in our environment, we have protective measures in place on affected systems, and we are working to complete patching.
We have reviewed our systems that use PHP and taken action, including applying fixes and recommended protective settings, adding monitoring and filtering to block known attack traffic, and restricting access where updates are still underway. We have not identified evidence of impact to customer data.
Our security team is continuing to investigate and will share updates as they’re available.
New SOC 1 & SOC 2 Audit Reports Available General June 3, 2026 Trust Center - Public
SPS has completed our latest SOC 1 and SOC 2 audits, conducted by BDO USA, P.C., covering the period from April 1, 2025 through March 31, 2026. All reports are now available for download on the Trust Center.
This release includes four reports: a SOC 1 and SOC 2 for the Fulfillment System, a SOC 2 for Revenue Recovery, and a SOC 2 for the Supply Chain Performance System. Revenue Recovery and Supply Chain Performance now have dedicated Trust Center product pages, where their respective SOC 2 reports and security program details can be found.
This SOC 1 release also fulfills the April opinion cycle of our semi-annual reporting schedule. Our next semi-annual SOC 1 report will cover the period from October 1, 2025 through September 30, 2026.
To request access to any report or learn more about our security program, please visit our Trust Center.
New SOC 1 Report Published
SPS has completed our latest SOC 1 audit, and the final report is now available for download on the Trust Center. This report covers the period from October 1, 2024 through September 30, 2025.
Beginning this year, SPS has transitioned to overlapping semi-annual SOC 1 reporting. This updated approach is designed to provide more continuous assurance for our publicly traded customers, whose fiscal year-ends vary throughout the calendar year.
This release represents our first SOC 1 report with a September audit opinion, and we expect this timing to continue going forward—in addition to our previously issued annual end-of-March SOC 1 report.
Our next semi-annual SOC 1 report will cover the period from April 1, 2025 through March 31, 2026.
New SOC 2 Audit Reports Available
We are pleased to announce that our latest SOC 2 audit reports, conducted by BDO, are now available for review. This update reflects our continued commitment to maintaining a standard of security and customer trust. In addition to updating our existing SOC 2 report, we are excited to introduce a new SOC 2 report for Traverse Systems, now part of our Supplier Performance Suite. This expansion underscores our dedication to security and trust across all components of our platform. To request access to the reports or learn more about our security program, please visit our Trust Center.
New SOC 1 Report Published
SPS has completed our latest SOC 1 audit and published the final report which is now available for download on the Trust Center. This report covers the period of 4/1/2024 to 3/31/2025.
Starting this year, SPS is transitioning to overlapping semi-annual SOC 1 reports. This change is intended to ensure adequate coverage for our publicly traded customers whose fiscal years end at different times throughout the calendar year. The next semi-annual report will cover the period of 10/1/2024 to 9/20/2025.