Tenant isolation at the database level
Every table enforces PostgreSQL row-level security. One company can never read, query or infer another company's members, plans, orders or invoices — and resellers only ever see the accounts assigned to them.
Encryption in transit and at rest
TLS 1.3 is enforced on all web, dashboard and API traffic. Databases, backups and uploaded files are encrypted at rest with AES-256.
No card data on our servers
Card payments are handled entirely by Stripe's PCI-DSS Level 1 hosted checkout. We never receive, process or store card numbers, CVVs or bank credentials.
No employee traffic monitoring
eSIM Office is a connectivity management platform, not a VPN, proxy or monitoring tool. Mobile data flows directly between the device and the local licensed operator; we do not inspect, route or log browsing activity, URLs, DNS lookups or app usage.
API keys stored as hashes only
Partner and reseller API keys are stored exclusively as SHA-256 hashes and shown in full only once at creation. Each key resolves server-side to exactly one account; requests for another account's data are rejected. Revocation is immediate.
Role-based access and spend governance
Separate roles for platform administrators, company administrators, employees and resellers. Company administrators decide per employee whether purchases require approval or can be made directly, and every order and invoice stays visible to the company.
Data we hold — and deliberately do not
We collect only what is required to assign and support corporate eSIMs.
- Company accounts: legal name, billing country and address, administrator name and business email, invoice and order history.
- Employee profiles: name, business email, position, department, assigned plans and eSIM identifiers (ICCID), plus plan data usage reported by the carrier.
- Never collected: browsing history, message content, contacts, device location or GPS tracking, and personal payment card details.
Infrastructure and sub-processors
The platform runs on managed cloud database, storage and edge compute services, with payments by Stripe, eSIM fulfilment through authorised wholesale carrier partners, and a dedicated transactional email service for activation codes and password links. We rely on the certifications and controls of these providers for the underlying infrastructure and payment network.
ESIMOFFICE LLC does not currently hold its own SOC 2 or ISO 27001 certification. We are happy to complete security questionnaires and to sign a Data Processing Addendum, including EU Standard Contractual Clauses, for enterprise customers.
Service limits we state openly
- Mobile coverage and speed depend on local licensed operators, terrain and network conditions; connectivity is provided on a commercially reasonable basis.
- Data allowances are subject to each operator's fair use policy, which is shown on the plan before purchase.
- Employee devices must be eSIM-capable and carrier-unlocked; compatibility remains the purchasing company's responsibility.
- Invoices and transaction records are retained to meet statutory accounting and tax obligations even after an account is closed.
Reporting a vulnerability
Email security@esimoffice.com with details of the issue and how to reproduce it. Please give us reasonable time to investigate and remediate before any public disclosure. The same address handles security reviews, DPA requests and enterprise compliance questionnaires.