Security
Security at PriceMonk
Your pricing data is some of the most commercially sensitive data in your business. Here is what we do, what we don’t yet do, and how we’ll tell you about the difference.
Honesty statement
PriceMonk is an EU-based SaaS operated by TopMonks s.r.o., which holds ISO/IEC 27001, ISO 9001 and ISO/IEC 42001 certification (certificates TDS 55/2026, TDS 56/2026 and TDS 74/2026; the 27001 scope covers software development and support including pricing solutions, plus data engineering and analysis). Below is what is in production today, what is not, and what you can ask for during a pilot.
Where something is not implemented, this page says so plainly and does not give a date. We would rather tell you what is true today than publish a target that quietly goes stale. If a control your security team requires is missing, raise it during discovery and we will tell you where it actually stands.
At a glance
Every row below is stated in full further down the page. Nothing here is a claim that the detailed sections do not make.
Where your data lives
- EU by default, elsewhere only by agreement. PriceMonk runs on EU infrastructure with EU data residency by default, and your data does not leave the EEA without prior written agreement. If you require a different region we can deploy in any region AWS operates, again by written agreement.
- One exception, stated plainly. Our control plane — the record of which plan you are on and which users you have — is held by us. Your pricing data itself stays in the region you agreed.
- A dedicated account, not shared tenancy. Each customer runs in its own dedicated AWS account. Where you want to verify that rather than take our word for it, we can give your team read access to that account, so the environment holding your data is auditable by you.
- What we do not offer. PriceMonk is not deployed into customer-owned infrastructure, and there is no on-premises option. If your security posture requires software running inside your own estate, we are not the right fit and would rather say so here than discover it in month three.
Encryption
- In transit. All client–server communication uses TLS 1.2 or higher. Authentication cookies are flagged
SecureandHttpOnly; HTTPS is enforced at the edge of the PriceMonk-hosted offering. - At rest. Customer data is encrypted at the storage layer using the cloud provider’s managed KMS in the EU region. Field-level (column-level) encryption for individual sensitive columns is not implemented.
- Keys. Managed by AWS KMS in the region holding your data, with rotation per provider default.
Identity and access
- Authentication. Username and password, backed by short-lived JWT access tokens with refresh-token rotation.
- Single sign-on (SAML 2.0 / OIDC). Available. PriceMonk integrates with your identity provider, so account provisioning and de-provisioning stay under your control.
- Multi-factor authentication. Available.
- Role-based access control. Yes. PriceMonk supports role-based permissions and segregation-of-duties patterns — each price change is routed by rule to the approver role you choose. The exact role catalogue is confirmed during onboarding for your team structure.
Audit logging
Every change to a price list, every approval action (propose, approve, reject, publish), every login and every role change is logged with the actor, the timestamp, and the prior and new value. Application-level audit logs are append-only.
Database-level WORM immutability and a SIEM-export API are not implemented. For customers who need an external attestation surface, we offer a daily signed export of audit records to a customer-controlled S3 bucket.
Attestations and compliance
- ISO/IEC 27001 — information security management. PriceMonk is operated by TopMonks s.r.o., whose information-security management system is certified to ČSN EN ISO/IEC 27001:2023 — the Czech and European adoption of ISO/IEC 27001:2022 — under certificate TDS 55/2026, issued 18 June 2026 by TDS Brno / TDS CERT (certification body for management systems no. 3105, accredited by the Czech Accreditation Institute under ČSN EN ISO/IEC 17021-1:2016), valid to 26 June 2028. It follows certification audit 350/2025 and surveillance audit 350/2026, and supersedes the earlier certificate TDS 54/2025. The Statement of Applicability is version 2, dated 13 April 2026.
The certified scope is software development, consulting, implementation, provision of 24/7 support, maintenance and administration of software solutions, including pricing solutions; automation and digitalisation, data engineering, data analysis and data visualisation. The certificate is available on request via security@pricemonk.io. - ISO 9001 — quality management. TopMonks s.r.o. also holds a quality management system certified to ČSN EN ISO 9001:2016 — the Czech and European adoption of ISO 9001:2015 — under certificate TDS 56/2026, issued by the same body, valid to 17 June 2029, over the same scope. Available on request.
- ISO/IEC 42001 — AI management. TopMonks s.r.o. also holds an AI management system certified to ISO/IEC 42001:2023 under certificate TDS 74/2026, issued 10 September 2026 by TDS Brno / TDS CERT, valid to 9 September 2029. It follows certification audit 701/2026. The Statement of Applicability for the AI management system is version 1, dated 25 August 2026.
The certified scope is the design, development, provision and use of artificial intelligence systems in the fields of software development, consultancy, implementation, 24/7 support, maintenance and management of software solutions, including pricing solutions, automation and digitalisation, data engineering, data analysis and data visualisation. Available on request. - SOC 2. We do not currently hold a SOC 2 Type 1 or Type 2 report. Customers who require SOC 2 should raise it during contracting; we offer a written security-controls statement and a bridge letter in lieu.
- GDPR. PriceMonk operates within the EU as a data Processor. A GDPR-compliant Data Processing Agreement (DPA) is signed alongside the Master Services Agreement and includes Standard Contractual Clauses where applicable. The DPA is available on request via security@pricemonk.io.
- PCI DSS. Out of scope. We do not handle cardholder data.
- External penetration test. We have not commissioned one. We run internal review and dependency-vulnerability scanning, and we will share the scope and findings of any testing we do commission, on request under NDA.
Sub-processors and data sharing
PriceMonk maintains a current sub-processor list (hosting, monitoring, support tooling). It is provided to customers at contract signing and on request via security@pricemonk.io. Customers are notified in writing thirty days before a new sub-processor is added, with a right to object.
Data isolation
Isolation is at the AWS account boundary: each customer has a dedicated account, so separation is enforced by the cloud provider rather than only by application logic.
No lock-in
Your data is yours. Export of price lists, audit history, and configuration is available on request and is contractually preserved at termination. Because your data sits in a dedicated account, an export is a copy out of a known, single location rather than an extraction from shared storage.
Reporting a vulnerability
If you believe you have found a security issue in PriceMonk, please email security@pricemonk.io. We acknowledge reports within two business days and aim to remediate in line with severity. We do not currently operate a public bug bounty.