Skip to content

SECURITY AND COMPLIANCE

Enterprise-grade from day one.

Tenant isolation, encryption of every sensitive field, a full audit trail and POPIA-aware handling of personal information. Nothing reaches your ERP without a record.

Book a 30-minute demoRequest the security overview
TENANTENCRYPTED STORECONNECTORSage 200AUDIT LOG

How does Weeva protect our order data?

Each client runs in an isolated tenant with its own encryption key. Customer names, account numbers, addresses, terms and uploaded documents are encrypted at rest. Access is controlled per user and per action. Every edit, approval, sync and deletion is recorded with the user and the time. Documents are treated as data by the AI, never as instructions. Nothing is pushed to your ERP without a record.

Which security controls does Weeva apply?

Seven controls, stated plainly.

Security controls in the Weeva platform

  • Tenant isolation

    What it means
    Each client has its own encryption keys for customer names, IDs, addresses, terms, notes and file names. Uploaded documents are encrypted at rest.

  • Access control

    What it means
    Per-user permissions to view, submit and configure. Every route in the platform checks them.

  • Audit

    What it means
    Every field edit is recorded with the value before and after. Approvals, syncs, deletions and catalogue changes are audited.

  • Prompt safety

    What it means
    Document content is treated by the AI as data, never as instructions. It is capped and wrapped before the model sees it, and matching is restricted to your catalogue, so an instruction hidden in a document cannot invent a product.

  • Outbound safety

    What it means
    Connector addresses are restricted, webhooks are signed, and document viewers use short-lived access tokens.

  • Post-sync lock

    What it means
    Once an order is synced, operators cannot edit it. Corrections after sync are recorded, never re-pushed.

  • Spreadsheet safety

    What it means
    Formula injection is neutralised in every Excel and CSV export.

What data does Weeva keep, where, and for how long?

What we store, and what happens to it.

  • What Weeva stores

    The orders and delivery notes you send, the source documents they came from, your catalogue, customer list and price lists as read from your ERP, and the audit log of every action.

  • How long

    Orders keep their source documents for as long as the order is held, so the audit trail stays complete. Retention periods are agreed with you in your contract.

  • Hosting and sub-processors

    Our hosting region and the full list of sub-processors are set out in the security overview, which we share on request. Ask us at [email protected].

  • Deletion

    Your data is deleted on request, subject to the retention your contract and the law require.

How does Weeva handle POPIA?

POPIA-aware by design.

Read the POPIA notice

  • Weeva as operator

    For the personal information in your orders, such as your customers' contact names and delivery addresses, you are the responsible party and Weeva is the operator, processing it only on your instructions.

  • Lawful basis and purpose limitation

    Personal information on orders and delivery notes is processed only to capture, match, review and post those documents, under the agreement between us.

  • Data subject requests

    Requests from your customers or staff are routed through you as the responsible party. Weeva helps you respond.

CERTIFICATIONS

We are happy to complete your security questionnaire and share our controls in detail.

Download the company overview

What IT teams ask about security.

Is our data kept separate from other clients' data?

Yes. Each client runs in an isolated tenant with its own encryption keys. Customer names, IDs, addresses, terms, notes and file names are encrypted with your tenant's keys, and uploaded documents are encrypted at rest. Every action inside your tenant is recorded against the user who took it.

Who at Weeva can see our orders?

Inside your account, permissions are set per user and per action: who can view, who can submit to the ERP and who can change configuration. Every action in the platform is attributed to the person who took it. Ask us for the detail on how Weeva's own support access is controlled.

Can a document trick the AI into doing something it shouldn't?

Document content is treated as data, never as instructions. Text from an order is capped and wrapped before the model reads it, and matching is restricted to your own catalogue, so an instruction hidden in a PDF cannot invent a product. Nothing reaches your ERP without passing the same checks and review as any other order.

Can an order be changed after it is posted to the ERP?

Not by an operator. Once an order is synced, it is locked. Corrections made after that are recorded against the order with the user and the time, but they are never pushed to the ERP a second time, so what your ERP holds and what Weeva's audit trail shows always reconcile.

Are you POPIA compliant?

Weeva is designed with POPIA in mind. For the personal information in your orders, you are the responsible party and Weeva is the operator, processing it only on your instructions under our agreement. Our POPIA notice sets out what we process, why, how it is secured, and how data subjects exercise their rights.

Do you hold ISO 27001 or SOC 2 certification?

We do not list certifications we do not hold. What we do offer is detail: we will complete your security questionnaire, walk your IT team through the controls on this page, and answer questions about hosting, sub-processors and retention before you share a single order with us.

See Weeva on your own orders.

Pick a time that suits you. Bring three sample orders, including one your team finds awkward, and we'll run them through extraction and catalogue matching live. No obligation.

Book a 30-minute demoEmail us