Security & Compliance

What Primentra holds, what leaves your network, and which certifications exist. This page answers the questions a vendor security review asks.

Certifications

Primentra holds no third-party security certification. There is no ISO 27001 certificate, no SOC 2 report, and no external audit report to reference.

Kraaitje B.V., the company behind Primentra, is a small vendor. At that size a certification audit costs more than it demonstrates, so we publish the architecture instead and let you verify it against your own installation.

That trade is only reasonable because of what Primentra is. A cloud MDM vendor holds your master data and has to prove it protects it. Primentra never receives your master data at all.

What leaves your network

The Primentra API server contains no HTTP client. It opens two kinds of outbound connection, and no others:

There is no telemetry, no usage reporting, and no licence call-home. Licence keys are decoded on your own server from the key itself, so an installation with no route to the internet behaves exactly like one that has it.

The update check runs in the browser, not on the server

Primentra tells an administrator when a newer release exists. That check runs in the administrator's browser against the GitHub releases API. The server never makes it.

This is deliberate. On-premises servers frequently have no outbound internet while the administrator's laptop does, and a server-side check would need an outbound firewall rule your security team has to approve.

Block it and nothing breaks. Every failure is silent, and the rest of Primentra behaves the same.

Where your data lives

Your master data lives in your SQL Server, in a database you created, on hardware you control.

• Backups are yours. Primentra creates none and reads none.
• Retention is yours to set. See Data Retention.
• Deletion happens when you delete. Nothing is copied elsewhere first.

We are not a processor of your master data, because none of it reaches us.

When a licence or trial ends

The application becomes read-only. Nothing is deleted and nothing is transmitted. The data stays in your SQL Server, where you can still read and query it directly. Entering a valid key restores editing. See Licensing.

Personal data the company holds

Separate from the product, Kraaitje B.V. holds the records any supplier holds about a customer:

• The contact and order record: name, email address, company name, billing address, VAT number, and any purchase-order reference.
• Website analytics, and only when a visitor accepts cookies.

None of it comes from your Primentra installation. The full statement is the Privacy Policy.

Technical controls

The controls are documented in full on Three-Tier Design & Security. In summary:

• The API server binds to localhost only. IIS terminates TLS 1.2 or later in front of it.
• Every database call is a parameterized stored procedure. The application contains zero raw SQL.
• The service account holds rights inside the Primentra database and nowhere else, with no server-level permissions.
• Role-based permissions are enforced server-side before every read and write.
• SQL error numbers, stack traces and connection strings go to the server log, never to the browser.
• Every write is recorded in the audit log with the user, the timestamp, and the old and new value.

Related

• Three-Tier Design & Security — the controls on each tier and the path a request takes
• Roles & Permissions — how the RBAC matrix is configured
• Audit Log — what is recorded on every change
• Data Retention — setting how long history is kept
• Production Deployment (IIS) — configuring TLS in front of the API server