Enterprise Edition Security Overview

Spree Commerce and its Enterprise Edition are engineered with robust security practices designed to meet the expectations of enterprise customers performing formal security reviews aligned with SOC 2 Type 2 and ISO/IEC 27001 standards.

This document summarizes Spree’s security principles, development practices, infrastructure protections, and data-handling safeguards, providing assurance for procurement teams, risk assessors, and compliance auditors.

1. Secure Software Development Lifecycle (SDLC)

Our Secure Software Development Lifecycle (SDLC) ensures that every Spree Commerce release - Community or Enterprise - is developed, tested, and maintained following industry best practices.

Governance and Oversight

• Managed directly by the CTO and senior leadership.
• Regular internal and external code reviews ensure continuous improvement.
• Third-party penetration testing to identify and mitigate security weaknesses early.

Secure Development Practices

• Compliance with OWASP Top 10 and Ruby on Rails security guidelines to prevent injection, CSRF, XSS, and mass-assignment vulnerabilities.
• All code undergoes peer review and CTO approval before merging.
• Dependencies are automatically updated using GitHub Dependabot or GitLab Dependency Scanning.
• SAST, DAST, and SCA scanning.

Vulnerability Management & Incident Response

• Vulnerabilities are triaged by severity, ensuring critical issues are addressed immediately.
• Customers receive proactive notifications for relevant security updates.
• Incident response includes identification, containment, mitigation, and transparent communication.

Data Protection

• All customer data is encrypted in transit (TLS) and at rest (AES-256).
• Access control follows least-privilege principles.

2. Security-by-Design (Ruby on Rails Foundation)

Spree API is built on Ruby on Rails, a framework known for its strong “security-by-default” architecture. Rails powers global companies like Shopify, GitHub, Airbnb, Kickstarter, and Square—proving its enterprise readiness.

Core Security Features

• Injection Prevention: ORM layer prevents SQL injection via parameterized queries.
• CSRF Protection: Rails automatically embeds authenticity tokens in forms to prevent cross-site request forgery.
• XSS Mitigation: Built-in HTML escaping and sanitization in views.
• Strong Parameters: Whitelists input attributes to prevent mass assignment.
• Session & Cookie Security: Signed, encrypted cookies and session management by default.

These features make security intrinsic to Spree’s architecture—not an afterthought.

3. PCI Compliance

Spree Commerce does not store or process payment card data. Instead, it integrates with PCI-DSS compliant processors (e.g., Stripe, Adyen).

• Only encrypted payment tokens are stored to link users with payment profiles in the processor’s system.
• For convenience, Spree retains limited metadata (card type, last four digits, expiry date) to enhance UX without exposing sensitive data.
• To satisfy PCI requirements 6.4.3 and 11.6.1, we recommend using Cloudflare PageShield for client-side integrity monitoring, ensuring protection against form-jacking or malicious scripts.

4. Production Security

Spree’s production environments are recommended to be secured using modern infrastructure and trusted third-party services, for example:

• PCI-compliant payment processors (Stripe, Adyen)
• Cloudflare: DDoS protection, WAF, rate limiting, bot mitigation
• GitHub/GitLab: Source integrity, dependency scanning, vulnerability alerts
• Strict change management via Git-based workflows and CI/CD validation
• Automated backups with reliable recovery
• Continuous monitoring and logging for audit readiness

5. Authentication, SSO, and MFA

Spree supports modern authentication mechanisms for both the storefront and admin dashboard.

Built-in Security

• Secure session handling, password hashing (bcrypt), and rate-limited login attempts.
• Role-based access control with least privilege enforced.

SSO & MFA Integrations

• Admin Dashboard Single Sign-on: Integrates with Okta, Auth0, Azure AD, Google Workspace, etc.
• Storefront Social Login: Supports OAuth, OpenID Connect, and social logins (Google, Facebook, Apple).
• MFA: Can be enforced at the identity provider level or through custom add-ons.

6. Enterprise Edition Security Enhancements

The Spree Commerce Enterprise Edition includes additional enterprise-grade security and governance capabilities, among others:

• Data Encryption: Full encryption in-transit (TLS 1.2+) and at-rest (AES-256).
• Single Sign-On (SSO): Optional integration for centralized identity management.
• Granular Roles & Permissions: Fine-grained access control across admin and API endpoints.
• Audit Trail: Every admin action is logged and reviewable for compliance audits.
• Custom Hosting Support: Enterprise customers can deploy Spree in ISO 27001 or SOC 2 compliant hosting environments (Render.com, AWS, GCP, Azure).

7. Compliance Alignment (SOC 2 / ISO 27001)

While Spree Commerce is a self-hosted platform—meaning its overall security depends on each customer’s infrastructure, configuration, and operational practices—it cannot itself be formally certified under SOC 2 or ISO 27001. However, its security controls are closely aligned with these standards and modeled on equivalent best-practice frameworks.

Control Domains Alignment

Domain	Practice
Security	Access controls, vulnerability management, encryption, secure SDLC
Availability	High availability design, backup and disaster recovery
Confidentiality	Encryption of data, least-privilege access, NDAs
Integrity	Code reviews, CI/CD with automated testing
Privacy	Data minimization, no storage of payment or personal card data

Security Testing

• Penetration testing and vulnerability assessments performed before major releases.
• Static and dynamic scanning across code and infrastructure.
• Annual independent third-party testing (available for Enterprise customers under NDA).

Business Continuity and Disaster Recovery

• Regular offsite encrypted backups with retention policies.
• Disaster Recovery (DR) procedures tested annually.
• RTO/RPO objectives designed to maintain service continuity and data integrity.

8. Transparency and Open Source Assurance

Spree’s open-source transparency is a unique security advantage:

• Publicly reviewable source code eliminates supply-chain opacity.
• Rapid community-driven identification and patching of vulnerabilities.
• Optional enterprise-only repositories provide controlled, hardened distributions.

9. Continuous Improvement

Security is never static. Spree maintains an evolving program of policy reviews, training, and threat intelligence updates to anticipate new risks. Lessons learned are integrated back into the SDLC to continuously strengthen the platform.

10. Enterprise Support

The Spree Commerce Enterprise Edition includes access to Premium Support, a partnership-level service designed to enhance security, compliance, performance, and innovation.

Premium Support provides direct access to the Spree core engineering team offering priority assistance covering, among others:

• Security & compliance – proactive patching, vulnerability guidance, and configuration reviews.
• Performance & reliability – optimization of caching, scaling, and infrastructure.
• Custom development & integrations – secure enhancements and system interconnections.
• Continuous improvement – upgrades aligned with the Spree roadmap and underlying software versions.

This ensures enterprise customers remain secure, compliant, and high-performing while continuously evolving their digital commerce environments.

Get Started

<Columns cols={2}> <Card title="Book a Demo" icon="eye" href="https://getvendo.com/book-a-demo/" cta="Click here"> Schedule a demo to explore the platform and get your questions answered </Card> <Card title="Ask for Pricing" icon="dollar-sign" href="https://spreecommerce.org/get-started/" cta="Click here"> See Enterprise pricing for your use case </Card> </Columns>