AutomaMRO security

Security and data protection at AutomaMRO

How Automa.Net hosts, protects and processes your material master and inventory data in AutomaMRO. Written for the IT security, data protection and procurement teams reviewing it.

Last reviewed: November 4, 2026

Hosted in the EU: AutomaMRO stores customer data on Microsoft Azure in France Central, with support from the EU.
Encrypted in transit and at rest: AutomaMRO encrypts data with TLS in transit and AES-256 at rest, backups included.
MFA for every account: Every AutomaMRO account can be protected with a second factor from an authenticator app.
No AI training: AutomaMRO does not use customer data to train its own or third-party AI models.

Hosting and data residency

Where is AutomaMRO data hosted? In the EU. The application, its databases, uploaded files and backups run on Microsoft Azure in the France Central region and in EU storage regions, and Automa.Net provides support and maintenance from within the EU.

Customer data is stored in the EU: AutomaMRO databases run on Microsoft Azure in France Central. Uploaded files and encrypted backups are kept in EU regions.
Operated from the EU: Administration, support and maintenance of AutomaMRO are carried out from within the EU.
Managed by Automa.Net: Automa.Net runs the application, its databases and the cloud infrastructure behind it. Your team only needs a current web browser.
EU-only access on request: If your policy requires it, access to your company account can be limited to users connecting from EU locations.

Network protection and encryption

How does AutomaMRO protect data in transit and at rest? Every request passes through Cloudflare's web application firewall and DDoS protection, all traffic is encrypted with TLS, and stored data is encrypted with AES-256.

Edge protection: All traffic to AutomaMRO passes through Cloudflare, with a web application firewall, DDoS mitigation and bot protection in front of the platform.
Encryption in transit: All communication with AutomaMRO uses HTTPS (TLS). Plain HTTP requests are only redirected to HTTPS.
Encryption at rest: AutomaMRO databases, file storage and backups are encrypted with AES-256.
Authenticated system emails: Notifications and password resets are sent from an Automa.Net domain with SPF, DKIM and DMARC, which makes spoofed emails easier to reject.

Data isolation and ownership

Can other companies see our data in AutomaMRO? No. Every record belongs to one company account, access is checked at every layer of the application, and your data is used only to deliver the services you ordered.

Isolated per company account: Every AutomaMRO record belongs to one company account, and access is checked at every layer of the application. No customer can see another customer's data.
Separate accounts for entities: Plants or legal entities can run as separate company accounts. Visibility across sites is set up only for the locations you approve.
Your data stays yours: You keep ownership of your material and inventory data. Automa.Net never sells it, never shares it with other members and never publishes it with your company attached.
Export when the contract ends: When your contract ends, you can request an export of your data before it is deleted under the data processing agreement.

Access and authentication

How do users sign in to AutomaMRO? With Automa.Net accounts that can be protected by multi-factor authentication. Access to production systems is limited to authorised Automa.Net engineers.

Multi-factor authentication: AutomaMRO accounts can be protected with a time-based one-time code from apps such as Google Authenticator or Microsoft Authenticator.
Roles within your account: Administrators manage users and settings for your company account. Users work with the platform's standard features.
Restricted production access: Only authorised Automa.Net engineers can reach AutomaMRO production systems, through zero-trust network access and MFA.
Reviewed infrastructure changes: Changes to the AutomaMRO infrastructure go through reviewed Git commits rather than manual edits, so every change is tracked.

Secure development

How is AutomaMRO developed securely? Every change goes through code review, automated tests, static code analysis and dependency scanning before release, under an application security policy based on OWASP guidance.

Policies based on OWASP and ISO 27001: The Automa.Net application security policy follows OWASP guidance, and its security controls follow the ISO 27001 framework.
Controlled releases: AutomaMRO is deployed automatically from reviewed code, and every customer always runs the latest production version.
Dependency monitoring: Known vulnerabilities in open-source dependencies are detected automatically and fixed through update pull requests.
Your own security testing: You can run your own security assessment or penetration test of AutomaMRO once scope, method and timing are agreed in writing.

AI and your data

Does AutomaMRO train AI on customer data? No. Materials are matched mainly against Automa.Net's own database of 10.5M+ spare parts from 9000+ manufacturers. OpenAI, Microsoft Azure OpenAI and Google Gemini assist in selected cases, without training on the data submitted.

No training on your data: Automa.Net does not use AutomaMRO customer data to train or fine-tune its own models or third-party models. The paid AI services it uses do not train on submitted data.
Only what the task needs: Each AI request carries only the material data needed for that task, such as a part number or description.
Where AI requests are processed: Requests to OpenAI and Google Gemini may be processed in the United States. All other AutomaMRO data is stored in the EU.
No decisions about people: AI in AutomaMRO works on product data only. It does not profile people, process biometric data or support HR decisions.

Privacy and GDPR

How does AutomaMRO handle personal data under the GDPR? AutomaMRO is a B2B service: your company is the data controller, and Automa.Net processes personal data on your behalf under a data processing agreement.

Data processing agreement: Categories of data, purposes and retention are set out in a DPA signed between your company and Automa.Net.
Minimal personal data: AutomaMRO processes only what the service needs: user names, business email addresses, sign-in data and system logs.
Data subject requests: Automa.Net helps you answer access, correction and deletion requests sent to [email protected].
Vetted subprocessors: Automa.Net works with a small number of vetted subprocessors, such as Microsoft Azure for hosting and Cloudflare for network protection. The full list, with processing locations, is part of the DPA.

Availability, backup and recovery

How does Automa.Net keep AutomaMRO available? The application is monitored automatically, backed up to encrypted storage in the EU and covered by the availability and support terms in your contract.

Continuous monitoring: AutomaMRO errors and performance are monitored automatically, with daily checks by the Automa.Net team.
Encrypted backups in the EU: AutomaMRO backups are encrypted and kept in the EU with restricted access.
Shared responsibility: Automa.Net operates, monitors and backs up AutomaMRO. Your company manages its users and the data it enters.
Service levels in your agreement: Availability targets, support hours and response times are set out in your contract.

Security documentation

For a vendor assessment, Automa.Net can send the documents security teams usually ask for:

Architecture overview: How the platform, its data stores and providers fit together, with backup and recovery objectives.
Penetration test summary: Scope and results of the external test.
DPA and subprocessor list: Our standard data processing agreement and the full list of subprocessors with locations.
Security questionnaire answers: Answers to the questions a vendor assessment usually covers.

Email [email protected] and we will send the documents your review needs.