SuiteReports — A Service of SuiteStep, LLC

2. Data Handling & Privacy

• Data Sources: SuiteReports only accesses NetSuite reports that a customer explicitly designates.
• Data Storage: All reports are stored in the customer’s own NetSuite File Cabinet. SuiteStep does not maintain long‑term storage of customer data outside of NetSuite.
• Data Ownership: Customers retain full ownership and control of their data at all times.
• Data Retention: SuiteStep does not store permanent customer data. Temporary process logs are automatically purged.
• Privacy: Designed with GDPR principles in mind (data minimization, transparency, and right to erasure).

3. Security Practices

• Authentication: Access to NetSuite is via a dedicated user account with minimum permissions required.
• Encryption: All data transfers between SuiteReports and NetSuite are protected by HTTPS/TLS.
• Isolation: Each customer’s configuration and credentials are isolated; no data is shared between customers.
• Access Control: SuiteStep personnel (limited to the founder/developer) access customer systems only when necessary for setup or support, and with customer consent.
• Incident Response: Affected customers are notified promptly in the event of a security or availability incident.

4. Operations & Availability

• Deployment: Operates within the customer’s NetSuite account, leveraging the File Cabinet for secure storage.
• Infrastructure: Services run on Amazon Web Services (AWS) using SOC 2–compliant data centers in the United States.
• Monitoring: Continuous monitoring for uptime and performance with automated alerts for anomalies.
• Backups: Configuration and service data are backed up daily and retained in encrypted form.
• Availability: Designed for high availability with automated recovery mechanisms.
• Change Management: Updates and improvements are developed and tested in isolated environments before deployment.
• Support: Direct support via email and phone; typical response within one business day.

5. Business Continuity

• Resilience: Reports remain available in the customer’s NetSuite File Cabinet even if SuiteReports is temporarily unavailable.
• Continuity Plan: In a prolonged disruption, customers can continue generating and storing reports manually in NetSuite.

6. Liability & Insurance

• Independent Vendor: SuiteStep, LLC is a small, independent software vendor.
• Insurance: SuiteStep maintains enterprise-level cyber liability and E&O policies. Proof of insurance is available upon request.

7. Compliance & Best Practices

While SuiteStep has not pursued formal certifications (e.g., SOC 2, ISO 27001), SuiteReports is developed and operated in alignment with industry best practices, including principles consistent with the SOC 2 Trust Services Criteria (security, availability, confidentiality).