Private access
Vault operations run server-side with a service role. They are not granted to garage, distributor or integrator sessions.
Public policy · version 1.0
External ERP credential security
This policy explains how PartnAir separates, stores, tests, activates, uses and revokes secrets required for an outbound ERP connection.
Effective 15 July 2026
Scope and boundary
- An outbound ERP credential is a secret entrusted to PartnAir to call a partner ERP. It cannot be used by a garage or a public integrator.
- An inbound PartnAir API key lets an integrator call public routes within its scopes. It cannot read, test or administer an ERP credential.
- The public Swagger documents only this inbound interface. It contains no public route to read, create, rotate or revoke an ERP secret.
Controlled lifecycle
1 · Candidate storage
The secret is sent to an admin-only server action, validated and placed in an encrypted vault. Only an opaque identifier and a non-sensitive hint remain with the connection.
2 · Test before activation
The candidate is tested separately. The test checks authentication and a bounded read capability; it creates neither a quote nor an order.
3 · Explicit activation
Only a candidate whose latest test succeeded can become active. The previous active credential becomes superseded and eligible for bounded purging.
4 · Rotation and revocation
Rotation follows candidate → test → activation again. Revocation stops use of the credential and deletes its value from the vault.
Technical controls
No re-exposure
After storage, the console never returns the secret value. It displays only type, status, dates and a server-derived hint.
Transport and destination
URLs must use HTTPS. Every DNS address is checked before each call; local, private or reserved targets are rejected, the validated address is pinned to the TLS socket and redirects are refused.
Auditability
Creation, test, activation and revocation create dated events without logging the credential value.
Inbound webhooks
Each distributor’s HMAC secret is also encrypted in the vault, available only to the verification backend and administered without ever displaying its value again.
Least privilege
ERP credentials should be restricted to operations required by the connector. Write actions remain separate from connection tests.
Incident response
A credential suspected of compromise can be revoked in the private console. Security incidents can be reported at the address below.
Verifiable public contract
The OpenAPI document explicitly marks the boundary “outbound ERP credentials: excluded”. Its only security mechanism is an inbound PartnAir API key. Swagger is read-only and Try it out is disabled.
Shared responsibilities
- The partner provides a dedicated, least-privileged technical account and rotates it under its internal policy.
- PartnAir protects the secret in its control plane, monitors tests and use, and enables revocation.
- This page claims neither certification nor an independent pentest result. Those items are published separately only after they have been obtained and verified.