Security at METIS

The questions your security team will ask, answered up front. This page describes what METIS does today, and nothing it does not.

Hosted on AWS, in your region

METIS is cloud-hosted on Amazon Web Services with regional data residency, so GCC clients' spend data stays in the Gulf. Specific residency arrangements can be agreed for enterprise deployments.

SOC 2: in progress, not claimed

SOC 2 certification is in progress. We will say so on this page when it is awarded, and not before. Until then, your security team can put its questions to us directly.

Encrypted and isolated

Data is encrypted in transit and at rest. Each client has its own database, so your data is never commingled with another client's.

Single sign-on and role-based access

METIS supports single sign-on and role-based permissions, and we recommend you use them.

Every purchase goes through your own approval chain and delegation of authority, with a human approval checkpoint on every transaction. The AI agents negotiate only inside the limits you set.

A full audit trail

Every sourcing decision, negotiation round and approval is logged and exportable, and every purchase order carries its audit trail.

Your data stays yours

Your identifiable spend, contract and supplier data is never shared with other clients or used to train models. Only aggregated, anonymised data, from which neither you nor any individual can be identified, is used to improve the platform. The same commitment is in our terms of service.

Approvals stay in your ERP

METIS connects by punchout to SAP, SAP Ariba, Oracle, Microsoft, Coupa, Zycus and Ivalua. METIS sources and negotiates; your ERP keeps the approvals and creates the purchase order, so spend never leaves your governance. Integration typically takes two to three weeks, including testing.

Personal data, sub-processors and incidents

We comply with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where it applies, the EU and UK GDPR. For platform data we act as processor, on your documented instructions.

Our sub-processors, including cloud hosting and AI model partners, are bound by data protection obligations no less protective than our own. A current list is available on request, and you get reasonable prior notice of any intended change.

If a personal data breach affects your data, we notify you without undue delay and within 72 hours of becoming aware of it.

More detail is in our privacy policy and terms of service. Questions from your security team? Email hello@collectivespend.com or book a call.

Questions we get asked