How we protect your data and keep it moving.
Your EDI carries purchase orders, invoices, and shipment data that your business depends on. Here’s exactly how it’s hosted, backed up, and protected — and what happens if something ever goes wrong.
Built on certified infrastructure
Foundational’s systems are hosted at Expedient, whose facilities and infrastructure carry SOC 1 Type II, SOC 2, SOC 3, HITRUST CSF Type II, HIPAA-compliant, and PCI-compliant certifications. Expedient publishes its own current compliance documentation directly at expedient.com.
Certified hosting, not just claimed
Rather than asserting our own infrastructure claims, we rely on and point to Expedient’s independently audited certifications — you can verify them directly at the source.
Dual-site replication
Our systems replicate from a primary site to a secondary site in an active-passive configuration, so a second facility is always ready if the primary is ever unavailable.
One clear division of responsibility
Expedient’s certifications cover the physical infrastructure — power, network, and facility security. Foundational’s own controls, covered next, handle everything above that layer: encrypted data in transit, access-controlled credentials, and VPN-gated remote access.
Who can actually touch your data
Because every member of our team is a senior specialist, any one of them can step in on your account immediately when something needs attention — there’s no waiting on access approvals or ticket-tier escalation to get someone qualified involved.
- All data in transit — every EDI transmission, every AS2/SFTP/API connection — is encrypted.
- Trading partner and connection credentials (VAN, API, SFTP) are stored in an access-controlled credential vault, not in plain text or shared documents.
- Remote access to any system touching client data requires VPN, except from our physical office locations.
“We deliberately keep our team small and senior rather than large and tiered — which means the person who picks up your issue already has the access and the expertise to actually resolve it.”
Recovery targets, stated plainly
These are targets, consistent with how we describe every commitment on this site — not guarantees. Below is exactly how backups, replication, and failover actually work.
Backups
Backups run daily, stored both locally for fast access and offsite for redundancy, with a two-week retention and rotation window.
Recovery targets
RTO target: 30 minutes
RPO target: minutes, likely seconds
Recovery time and recovery point targets for our infrastructure
Controlled failover
Failover to our secondary site is not automatic by design. A controlled failover lets us confirm no transactions are lost or duplicated before traffic moves — we’d rather take a deliberate extra step than risk your data integrity for speed.
Your data stays yours
Standard retention
Transaction data is retained for one year as standard. Extended retention windows can be negotiated for accounts that need them.
When you leave
Your data is yours. If you leave Foundational, your data is deleted, and it can be exported to you on request.
Insured
Foundational maintains cyber liability insurance as part of our operational risk management.
If something ever goes wrong
Security incidents get the same senior-team, no-queue treatment as any critical operational issue: whoever is available responds immediately, with the rest of the team ready to assist. Our target is to notify affected customers as soon as possible after confirming an incident — typically within one hour of Foundational becoming aware of it.
“We regularly complete detailed security and vendor questionnaires for enterprise customers as part of their own vendor review process — this page reflects the same answers we give them directly.”
Need this for a vendor security review?
If your team needs a formal security questionnaire completed, or wants to walk through any of this in more detail, we’re glad to have that conversation directly.
Or call 412-653-2463