Security

Where your data lives, and who can reach it.

You are being asked to put recall-critical records into software built by a small company. This page states what is true today, including the parts that are not finished.

Last updated 14 October 2026. Tray ERP is operated by IT-TECH, Montréal, Québec.

Hosting and data location

Application and customer data: The Tray ERP application and your operational data — products, lots, recipes, suppliers, customers, production records and the audit trail — are hosted in a Canadian region.
This website: trayerp.com is served by Cloudflare as a static site. It holds no customer data. Analytics run only if you accept them; see the Privacy & Cookie Policy.
What a Canadian region does not cover: Some infrastructure services are global by design. A hosting region governs where your records are stored and processed; it does not by itself mean every request or every feature stays inside Canada. The exception that applies to Tray is below, and we would rather name it than let you discover it.

The AI assistant, and where it runs

“Ask your warehouse” answers questions in plain language from a read-only query against your own data. It uses Amazon Bedrock with Amazon’s own models, called in-region in ca-central-1 — the same Canadian region the application runs in.

Does your data leave Canada when you use it?: No. Bedrock in-region processing means the request is served inside the region it is called in; AWS documents that such requests never leave the Region you specify. Data at rest — your records, logs and configuration — stays in Canada regardless.
Who is the subprocessor?: Amazon Web Services, which is also the infrastructure provider for the application itself. The assistant does not introduce a new vendor; it uses a service of the one already hosting your data.
It is still in beta: We label it that way because it is still changing. It is not required to use Tray. If you would rather it were switched off for your site, email [email protected] and we will disable it.
What it shows you: Every answer shows the query it ran and the rows it read, so you can check the figure rather than trust it. Where your data cannot answer the question, it says so instead of producing a number.

One caveat worth stating: a region governs where your records are stored and processed, but some AWS infrastructure services are global by design. If your compliance review needs the precise boundary in writing, ask and we will put it in writing.

Backups

Daily automated backups, encrypted.
A restore has been performed and verified. We state this because an untested backup is a hypothesis, and most vendors do not say which they have.

Access

Tray is multi-tenant. Your data is isolated to your tenant, and role-based access controls which of your own people can see receiving, production, reporting and administration.

On our side, access to production systems is limited to IT-TECH staff who need it to operate and support the service. IT-TECH is a small company; if you need to know exactly how many people that is and who, ask and we will tell you in writing.

Your data is yours, and you can take it

Every record — products, lots, BOMs, orders and the audit trail — is exportable to CSV or a full database backup at any time, at no charge, including if you leave. We do not use your recipes or production data to train models, and we do not share them with other customers.

Privacy and Québec Law 25

Tray ERP is operated from Québec and is subject to Québec’s private-sector privacy law (Law 25). If a confidentiality incident affecting your data occurs, we will notify you. How we handle information collected through this website is set out in the Privacy & Cookie Policy.

What we have not done yet

A security page that only lists strengths is marketing. These are open:

No third-party security certification. We hold no SOC 2, ISO 27001 or equivalent attestation, and we are not claiming one.
No published status page or uptime history. We previously advertised a 99.9% uptime target without measuring it. That claim has been removed from the site, and monitoring is being put in place before it goes back.
No formal penetration test by an external firm.
Single-operator risk. IT-TECH is small. If that matters to your procurement review, it should, and we would rather discuss it directly.

Reporting a vulnerability

Email [email protected] with enough detail to reproduce it. We will acknowledge within two business days. We will not pursue legal action against anyone who reports a vulnerability in good faith and does not access or alter other customers’ data.

Questions a procurement reviewer should ask

If you are evaluating Tray and need something this page does not cover — a signed data processing agreement, specifics of the hosting arrangement, insurance certificates, or the exact list of subprocessors — ask. If the honest answer is that we do not have it yet, that is the answer you will get.

[email protected]