SPS Trust Center
SPS Supply Chain Performance Management unifies supplier data across operations, logistics, and compliance for retailers tracking chargebacks, shipment progress, and 65+ performance metrics like fill rate, OTIF, and ASN accuracy. Security sits at the foundation of that system, not on top of it. Confidentiality of your data and integrity of every performance record are protected under the same controls, without exception, from day one.
Our infrastructure runs on AWS with encryption at rest and in transit, active intrusion detection, and disaster recovery built into the architecture. We hold SOC 2 Type 2 certification and run independent penetration testing on a regular cadence. A dedicated security team owns this work full-time, backed by a secure development lifecycle and continuous employee training. We're also RH-ISAC members and carry cyber insurance.
For security-related inquiries, reach out to security@spscommerce.com.
Policies
We are currently working with experts to put together our company policies. Please contact us for more details.
AI
We take the usage of AI seriously in our organization and work to ensure security and reliability of the AI.
Incident Response
We have a dedicated team that responds to security incidents. We are happy to provide more details about our incident response practices upon request.
Risk Management
We have a dedicated team that manages security risks. We are happy to provide more details about our risk management practices upon request.
Risk Profile
We have secure, reliable hosting that customers can depend on. We are happy to provide details about our risk mitigation practices and recovery objectives upon request.
Asset Management
We have strict asset management policies in place to ensure that all assets are accounted for and secure.
BC/DR
We have a business continuity plan in place to ensure that we can continue to operate in the event of a disaster.
Change Management
We have a change and configuration management process in place to ensure that changes are properly reviewed and approved.
Physical & Environment
We have physical and environmental controls in place to ensure that our data centers are secure and reliable.
Continuous Monitoring
We continuously monitor our systems for security threats and vulnerabilities. We are happy to provide more details about our continuous monitoring practices upon request.
Self-Assessments
We are working on our security compliance. We can provide completed questionnaires upon request.
Security Grades
We are constantly monitoring the security of our website. We will post our grades from public security rating agencies when they become available.
Subprocessors
- What is the NAICS Code for SPS?
- Are facilities protected by closed circuit security camera systems(CCTV)?
- Does your company have a risk assessment program?
- Does your service or solution support confidentiality and security when processing data on behalf of customer?
- Are individual/unique accounts assigned to personnel, including administrative users?
SPS Trust Center Updates
PHP Vulnerabilities — SPS Commerce Response (October 2026)
On October 21, the PHP project disclosed two critical security vulnerabilities in software used widely across the industry and released fixes. SPS Commerce acted quickly and we have not seen evidence of exploitation in our environment, we have protective measures in place on affected systems, and we are working to complete patching.
We have reviewed our systems that use PHP and taken action, including applying fixes and recommended protective settings, adding monitoring and filtering to block known attack traffic, and restricting access where updates are still underway. We have not identified evidence of impact to customer data.
Our security team is continuing to investigate and will share updates as they’re available.
New SOC 1 & SOC 2 Audit Reports Available General June 3, 2026 Trust Center - Public
SPS has completed our latest SOC 1 and SOC 2 audits, conducted by BDO USA, P.C., covering the period from April 1, 2025 through March 31, 2026. All reports are now available for download on the Trust Center.
This release includes four reports: a SOC 1 and SOC 2 for the Fulfillment System, a SOC 2 for Revenue Recovery, and a SOC 2 for the Supply Chain Performance System. Revenue Recovery and Supply Chain Performance now have dedicated Trust Center product pages, where their respective SOC 2 reports and security program details can be found.
This SOC 1 release also fulfills the April opinion cycle of our semi-annual reporting schedule. Our next semi-annual SOC 1 report will cover the period from October 1, 2025 through September 30, 2026.
To request access to any report or learn more about our security program, please visit our Trust Center.
New SOC 1 Report Published
SPS has completed our latest SOC 1 audit, and the final report is now available for download on the Trust Center. This report covers the period from October 1, 2024 through September 30, 2025.
Beginning this year, SPS has transitioned to overlapping semi-annual SOC 1 reporting. This updated approach is designed to provide more continuous assurance for our publicly traded customers, whose fiscal year-ends vary throughout the calendar year.
This release represents our first SOC 1 report with a September audit opinion, and we expect this timing to continue going forward—in addition to our previously issued annual end-of-March SOC 1 report.
Our next semi-annual SOC 1 report will cover the period from April 1, 2025 through March 31, 2026.
New SOC 2 Audit Reports Available
We are pleased to announce that our latest SOC 2 audit reports, conducted by BDO, are now available for review. This update reflects our continued commitment to maintaining a standard of security and customer trust. In addition to updating our existing SOC 2 report, we are excited to introduce a new SOC 2 report for Traverse Systems, now part of our Supplier Performance Suite. This expansion underscores our dedication to security and trust across all components of our platform. To request access to the reports or learn more about our security program, please visit our Trust Center.
New SOC 1 Report Published
SPS has completed our latest SOC 1 audit and published the final report which is now available for download on the Trust Center. This report covers the period of 4/1/2024 to 3/31/2025.
Starting this year, SPS is transitioning to overlapping semi-annual SOC 1 reports. This change is intended to ensure adequate coverage for our publicly traded customers whose fiscal years end at different times throughout the calendar year. The next semi-annual report will cover the period of 10/1/2024 to 9/20/2025.