Concur Data Security

The data privacy you need from a spend management partner you can trust

Security isn’t just a piece of software, it’s also peace of mind

As an SAP company, we’re serious about security. We're known for our innovative business solutions, and protecting your data, privacy, and digital assets is integral to this innovation. Read the eBook to learn how, with Concur, compliance can improve and your information is kept safe with built-in protections at every level.

Strong security starts with the right solution

The tools and technology your company adopts can affect every department. That’s why choosing the right solution is all the more important. Learn more about how SAP Concur can keep your data safe and set your organization up for long-term success.

Common questions about SAP Concur solutions

The decision to invest in new software often hinges on how well a solution addresses cybersecurity, data privacy, integration, and other critical areas. Here are answers to some of the most common questions we hear from IT teams.

Read the FAQ

Ways to reduce cybersecurity risks

As technology advances, so do cybersecurity risks. Protecting your company is a team effort and finance is a necessary collaborator in that fight. Here are 8 tips your IT and finance teams can use to create a comprehensive action plan.

Download the tip sheet

Integrations for secure flexibility

SAP Concur solutions are built to connect with your accounting, HR, ERP, and other systems in multiple ways, including SFTP, pre-built connectors, APIs, and more.

Learn about integrations

Security for the industries that need it most

Concur Cloud for Public Sector was built for highly regulated U.S. industries including federal, state, local, tribal, educational entities, and commercial contractors processing data on behalf of the U.S. Government. Hosted on Amazon Web Services (AWS) GovCloud infrastructure, it meets Federal Risk and Authorization Management Program (FedRAMP) security controls and other data security, confidentiality, and availability requirements without sacrificing useability.

Compliance standards, certifications, and audits

ISO 27001 & 9001
- The global standard for I.T. security management. BS7799 certified and audited since 2004 and ISO 9001 audited annually in conjunction with SAP.
ISO 27017
- Codes of practice for information security controls for cloud services.
ISO 27018
- Guidance for cloud service providers to protect personally identifiable information (PII).
ISO 22301
- Annually certified and audited business continuity management framework (BCMS) since 2021.
Payment Card Industry (PCI) Attestation of Compliance
- A Level 1 Visa registered CISP-compliant service provider. Audited annually by PCI Qualified Security Assessor (QSA).
SOC1 Type II
- SAP Concur transitioned to the SSAE18 and ISAE3402 standard in 2010, with audits every six months.
SOC2 Type II
- Since 2017, SAP Concur has added a SOC2 security audit report as well as audits every six months.
KRITIS
- Compliant with German cybersecurity measures for critical infrastructure.
Cloud Security Alliance (CSA) Security Trust Assurance and Risk Registry
- A three-tiered provider assurance program for cloud computing security.
FedRAMP
- In 2024, Concur Cloud for Public Sector received full Authorized status in accordance with the Federal Risk Assessment Management Program (FedRAMP) for managed cloud applications and services.
ACSC Cloud Security Assessment (IRAP)
- The Australian Information Security Registered Assessors Program (IRAP) assesses the strengths and weaknesses of a company's security systems and provides recommendations for improvements to organizational security.
Spain Esquema Nacional de Seguridad (ENS)
- The information systems that support the SAP Concur suite for Expense, Request and Travel services have been audited and verified to comply with ENS in 2024.
Information System Security Management and Assessment Program (ISMAP)
- Program administered by the Japanese government to assess the security of public cloud services.