Privacy Policy

1. Scope and Identity

ERPStack (“we”, “our”, “us”) is a systems engineering firm specializing in bespoke B2B applications. For our marketing website and tools (e.g., ROI Calculator, Architecture Grader), we act as the Data Controller. For client application hosting environments, we act strictly as a Data Processor under strict Statements of Work. Contact our privacy officer at support@erpstack.io.

2. Data Acquisition & Categorization

We process the following data classes under secure parameters:

• Identified Contact Information: Professional name, corporate email address, and project parameters supplied during form submission.
• Tool & Form Submissions: Answers you give the Architecture Grader, ROI Calculator inputs, and anything you choose to write in a message — stored encrypted at rest (AES-256) in our database. We never ask for credentials or connection strings through this site.
• Telemetry & Access Logs: IP address, routing parameters, and request timestamps compiled via server-side log routers. We do not correlate server logs with individual PII.
• Performance Telemetry: Aggregated Core Web Vitals collected via Vercel Speed Insights. No cross-site tracking cookies and no individual behavioral profiles are created.

3. Security & Database Infrastructure Safeguards

The controls below describe this website — not a generic aspiration:

• Transit & Rest Security: All endpoints enforce TLS 1.3. The site database (serverless PostgreSQL) encrypts data at rest with AES-256.
• Serverless Isolation: The site runs on immutable, per-deployment serverless functions — no long-lived servers to patch, no shells to compromise.
• Least-Privilege Data Access: Every database interaction goes through parameterized queries via a typed ORM; credentials live in platform environment vaults, never in code or the repository.
• Form Abuse Controls: Submissions pass honeypot checks and IP-based rate limiting before they are stored.

4. Subprocessors & Integrated Infrastructure

We use a small, fixed set of infrastructure subprocessors to host this site and its tools. Each one is listed here with what it does, where it runs, and the safeguards that bind it:

5. Legal Bases for Processing (GDPR)

We process personal data based on the following justifications:

• Contract Performance: Delivering requested technical resources, project estimates, or executing contracted systems development.
• Legitimate Interest: Protecting system integrity, preventing DDoS attacks via Edge rate-limiting, and managing active inquiries.
• Explicit Consent: Optional communication preferences, which may be rescinded at any time via written notice.

6. Retention Policies

We enforce strict data minimization regimes. Contact record submissions are archived for up to 3 years to ensure operational continuity. Server metadata and aggregated performance telemetry are purged automatically after 12 months.

7. Data Subject Rights & Cryptographic Verification

Under GDPR and UK GDPR regimes, you possess the right to access, rectify, restrict, or purge your records. To execute a Data Subject Access Request (DSAR):

• Submit your request directly to support@erpstack.io.
• Before exporting data, we verify identity via email authentication or a matching cryptographic signature check.
• DSAR reports are compiled and transmitted securely within 30 days of successful identity verification.

8. Cookie Implementations

We deploy strictly necessary cookies required for session authentication and CSRF token protection. Aggregated performance analytics use privacy-compliant, self-hosted scripts. You can block cookies via your browser configurations without affecting core website performance.

9. Amendments & Contact

We update this policy periodically to reflect evolving regulatory frameworks. For inquiries regarding data protection policies, contact our systems engineering leads directly at support@erpstack.io.