SAP Concur solutions: security and privacy

SAP Concur commits to maintaining the confidentiality, integrity, and availability of customer data and the development of solutions through the adoption of the SAP global security policy and internationally recognised standards.

CERTIFICATION AND COMPLIANCE

As a market leading cloud spend management platform, SAP Concur understands the importance of security in its assets, brand, people and of course, customer data. Security by design is implemented through our technology stack, providing for defence in depth and alignment with global standards. With SAP as our parent company, we align to a global security framework, shared responsibility model and trust service principals in our ongoing commitment to providing a secure service.

Learn more about certificates, reports, attestations for SAP Concur including Concur Expense, Concur Invoice and Concur Travel - Go to ISO, PSI DSS and SOC details

HOSTING

SAP Concur has over a hundred micro-services running in AWS which comprise of application, customer data, and backup services. Services are distributed across multiple availability zones with no single point of failure.

Learn more about data centre regions

SHARED RESPONSIBILITY MODEL FOR DATA SECURITY

Security and compliance responsibilities between SAP, customers and third-parties providing services under the agreement.

• SAP is responsible for the security of the cloud infrastructure.
• AWS as the hyper-scaler providing infrastructure-as-a-service is responsible for the physical security of the data center
• Customers are responsible for securing their applications and data within the cloud environment.

Learn more about the details

DATA PROTECTION AND PRIVACY

SAP cloud services offer enhanced DPP (data protection & privacy) protection to customers through robust security measures, data encryption, strict access controls, and compliance with global privacy regulations. Such measures ensure customer data remains both secure and confidential.

Learn more about DPA, SCCs, TOMs, TIAs and sub processor details

READ THE FULL BLOG POST FOR MORE DETAILS