Trust and security

EdiFabric is a small, founder-led company. We don't hold SOC 2 or ISO 27001 certification, and our engineering processes are lightweight rather than formally audited. This page explains what we do, so security and procurement teams can assess our software for themselves. If you need a security questionnaire completed, send it to us and we'll fill it in.

At a glance

• Your data stays with you. ediFabric .NET and ediFabric Native run inside your own process. EDI data, including PHI, is never sent to us.
• No third-party dependencies. The EdiFabric NuGet package and the ediFabric Native libraries don't depend on any third-party libraries, packages or products.
• Signed binaries. Native binaries are signed on every platform, and you can verify them before you install.
• A direct security contact. Report vulnerabilities to security@edifabric.com, and the people who write the code will answer.
• No certifications or audit reports. We don't have SOC 2, ISO 27001 or penetration test reports to share.

Where your data goes

• ediFabric .NET and ediFabric Native parse, validate, generate and acknowledge EDI on your own hardware. The only network call they make is the license check, which sends your serial key or token and nothing else. On Enterprise, offline tokens remove even that call.
• ediFabric Cloud is a hosted REST API, so the files you send are processed on our servers. The hosted service is not HIPAA or SOC 2 certified. For PHI or other regulated data, use .NET or Native, or host the same API yourself.
• EdiNation runs in your browser. Files you open in it stay on your device.

How we handle account and billing data is described in our privacy policy.

Third-party dependencies

We write the parser, validator and generator ourselves. The EdiFabric NuGet package lists no dependencies for any target framework, and ediFabric Native ships as a single library per platform that needs nothing beyond the operating system's standard libraries. There is no third-party code inside either product for you to track or patch, and no dependency tree that a compromised upstream package could reach.

The language bindings for ediFabric Native (Python, Java, Node.js, Go, Rust, C and C#) are thin wrappers around the same library, published as source on GitHub so you can read exactly what they do.

How we build and release

A small team means a short chain of custody. These are our practices:

• Source code is kept in private repositories. Only EdiFabric staff have access, and every change is tracked with its author and history.
• Code review. Changes are made by a small number of named developers. Every release is reviewed and approved by the founder before it's built and published.
• Testing. Each release is tested against our suite of sample and malformed EDI files for every supported standard before it's published.
• Build and signing. Release binaries are built and signed by EdiFabric. The signing keys and certificates are held by EdiFabric and used only for release builds.
• Distribution. ediFabric .NET is published only on NuGet under our reserved package prefix, and ediFabric Native only from our download page.
• Release notes. Every release is listed in the changelog.

Verify our binaries

Check the signature before you install ediFabric Native:

• Windows: edifabric-x12-tools.dll is signed with Authenticode. In PowerShell, run Get-AuthenticodeSignature edifabric-x12-tools.dll | Format-List and confirm the status is Valid and the signer is EDI Fabric Limited.
• Linux: each edifabric-x12-tools.so comes with a detached signature. Import our public signing key with gpg --import edifabric-signing-key.asc, confirm with gpg --fingerprint that its fingerprint is B538 12FB CAF1 F5D1 1B23 EC93 93B0 9965 4C69 8B36, then run gpg --verify edifabric-x12-tools.so.asc edifabric-x12-tools.so and look for Good signature.
• macOS: edifabric-x12-tools.dylib is signed with Apple codesign. Run codesign --verify --verbose edifabric-x12-tools.dylib.

NuGet verifies the package signature of ediFabric .NET when you restore it. The full instructions are on the download page.

Report a vulnerability

If you find a security issue in any EdiFabric product or website, email security@edifabric.com. Please include the product and version, the steps to reproduce, and the impact you expect. Please don't post it publicly until we've released a fix.

• We acknowledge reports within 2 business days and keep you informed until the issue is resolved.
• We fix confirmed vulnerabilities ahead of other work and release the fix as soon as it's ready.
• We publish fixed releases in the changelog and email affected customers directly.
• We credit reporters who want to be credited.
• We won't take action against anyone who reports an issue in good faith and avoids harming our customers or their data.

We don't run a paid bug bounty. Our contact details are also published in security.txt.

Compliance and documents

• Certifications: none. We don't hold SOC 2 or ISO 27001 certification.
• Independent review: EdiFabric has an approved listing in the U.S. Department of Veterans Affairs Technical Reference Model. See how the VA uses EdiFabric.
• Security questionnaires: we complete them on request. Send yours through the support portal.
• Legal: the EULA and privacy policy are on our legal page.
• Company: EDI Fabric Limited, incorporated in England and Wales, company number 8248816. See About us.