Trust and security

EdiFabric is a small, founder-led company. We don't hold SOC 2 or ISO 27001 certification, and our engineering processes are lightweight rather than formally audited. This page explains what we do, so security and procurement teams can assess our software for themselves. If you need a security questionnaire completed, send it to us and we'll fill it in.

At a glance

• Your data stays with you. ediFabric .NET and ediFabric Native run inside your own process. EDI data, including PHI, is never sent to us.
• No third-party dependencies. The EdiFabric NuGet package and the ediFabric Native libraries don't depend on any third-party libraries, packages or products.
• Signed binaries. Native binaries are signed on every platform, and you can verify them before you install.
• A direct security contact. Report vulnerabilities to security@edifabric.com, and the people who write the code will answer.
• Offline licensing with a continuity promise. Offline tokens make no license call once set, and the EULA commits us to how leaks are handled and what happens if the license service ever stops.
• No certifications or audit reports. We don't have SOC 2, ISO 27001 or penetration test reports to share.

Where your data goes

• ediFabric .NET and ediFabric Native parse, validate, generate and acknowledge EDI on your own hardware. The only network call they make is the license check. It sends your serial key or token, the product version and release date, and a snapshot of the environment for counting seats: the kind of environment and a one-way hash of its identifiers, never the identifiers themselves and never EDI data. On Enterprise and Perpetual, offline tokens remove even that call.
• ediFabric Cloud is a hosted REST API, so the files you send are processed on our servers. The hosted service is not HIPAA or SOC 2 certified. For PHI or other regulated data, use .NET or Native, or host the same API yourself.
• EdiNation runs in your browser. Files you open in it stay on your device.

How we handle account and billing data is described in our privacy policy.

Offline licensing and continuity

These commitments are in sections 4.3 and 4.5 to 4.7 of the EULA.

• No call home. Once an offline token is set, the libraries make no license call and we can't disable the token remotely. We won't add an undisclosed way to do so.
• Long-lived tokens. Enterprise can request a 1-year token, and Perpetual a 5-year token that covers the versions released up to the end of updates or maintenance, replaced free of charge before it expires. Tokens are issued after the trial or evaluation period to registered companies using professional email addresses, and are non-refundable once issued.
• What a token holds. A token identifies the customer and holds its expiry date and the versions it covers. It holds no EDI data.
• If a token leaks. Report it within 2 business days. If the leak was accidental, we replace the token at no charge, and the leak alone isn't grounds for termination. We can refuse a compromised token in later releases, but not on builds already running.
• If we stop. A long-lived token doesn't depend on us until it expires. If we ever intend to cease trading or permanently stop the license service with no successor, we'll give at least 90 days' notice and, to the extent we're lawfully able to, issue tokens without an expiry date or builds without license validation to current Enterprise and Perpetual customers.
• If your company changes hands. You can assign your license to a successor to your business on written notice.

Third-party dependencies

We write the parser, validator and generator ourselves. The EdiFabric NuGet package lists no dependencies for any target framework, and ediFabric Native ships as a single library per platform that needs nothing beyond the operating system's standard libraries. There is no third-party code inside either product for you to track or patch, and no dependency tree that a compromised upstream package could reach.

The language bindings for ediFabric Native (Python, Java, Node.js, Go, Rust, C and C#) are thin wrappers around the same library, published as source on GitHub so you can read exactly what they do.

How we build and release

A small team means a short chain of custody. These are our practices:

• Source code is kept in private repositories. Only EdiFabric staff have access, and every change is tracked with its author and history.
• Code review. Changes are made by a small number of named developers. Every release is reviewed and approved by the founder before it's built and published.
• Testing. Each release is tested against our suite of sample and malformed EDI files for every supported standard before it's published.
• Build and signing. Release binaries are built and signed by EdiFabric. The signing keys and certificates are held by EdiFabric and used only for release builds.
• Distribution. ediFabric .NET is published only on NuGet under our reserved package prefix, and ediFabric Native only from our download page.
• Release notes. Every release is listed in the changelog.

Verify our binaries

Check the signature before you install ediFabric Native:

• Windows: edifabric-x12-tools.dll is signed with Authenticode. In PowerShell, run Get-AuthenticodeSignature edifabric-x12-tools.dll | Format-List and confirm the status is Valid and the signer is EDI Fabric Limited.
• Linux: each edifabric-x12-tools.so, x64 and arm64, comes with a detached signature from one EdiFabric release key. Import our public signing key with gpg --import edifabric-signing-key.asc, confirm with gpg --fingerprint that its fingerprint is 8CC8 96FE F0A2 2676 BA1C 1E0C F811 022F 1286 11AE, then run gpg --verify edifabric-x12-tools.so.asc edifabric-x12-tools.so and look for Good signature.
• macOS: edifabric-x12-tools.dylib is signed with Apple codesign, with the Developer ID of EDI Fabric Limited (team 58CLK999J5). Run codesign --verify --strict --verbose=2 edifabric-x12-tools.dylib and codesign --display --verbose=2 edifabric-x12-tools.dylib, and check the Authority line.

NuGet verifies the package signature of ediFabric .NET when you restore it. The full instructions are on the download page.

Report a vulnerability

If you find a security issue in any EdiFabric product or website, email security@edifabric.com. Please include the product and version, the steps to reproduce, and the impact you expect. Please don't post it publicly until we've released a fix.

• We acknowledge reports within 2 business days and keep you informed until the issue is resolved.
• We fix confirmed vulnerabilities ahead of other work and release the fix as soon as it's ready.
• We publish fixed releases in the changelog and email affected customers directly.
• We credit reporters who want to be credited.
• We won't take action against anyone who reports an issue in good faith and avoids harming our customers or their data.

We don't run a paid bug bounty. Our contact details are also published in security.txt.

Compliance and documents

• Certifications: none. We don't hold SOC 2 or ISO 27001 certification.
• Independent review: EdiFabric has an approved listing in the U.S. Department of Veterans Affairs Technical Reference Model. See how the VA uses EdiFabric.
• Security questionnaires: we complete them on request. Send yours through the support portal.
• Legal: the EULA and privacy policy are on our legal page.
• Company: EDI Fabric Limited, incorporated in England and Wales, company number 8248816. See About us.