Trust and Security

This page summarizes who is responsible for what when you use JustOn software, which certifications and attestations cover it, and where to find the details. Use it as the first point of reference when your auditor, purchasing department or IT security asks for evidence.

In short:

• JustOn is a software vendor. JustOn software runs in your own Salesforce org. You run your business processes with it and remain responsible for them.
• JustOn inherits the security of its platforms. Salesforce Platform and Heroku are certified according to major security standards, including ISO 27001 and SOC 2.
• JustOn's own certifications confirm the software. NF203 and an audit according to IDW PS 880 confirm that JustOn Billing & Invoice Management enables proper, compliant accounting when used as intended. They do not certify the processes of the companies that use it.

Roles and Responsibilities

JustOn software, like JustOn Billing & Invoice Management or JustOn Cash Management, runs as integrated application on the Salesforce Platform and Heroku, the cloud-based platforms for software development and operation from Salesforce. Three parties share the responsibility:

JustOn is a software vendor, not a service provider that runs accounting processes or IT operations on behalf of its customers. The software is installed in the customer's own Salesforce org, to which JustOn has no access unless the customer explicitly grants it, for example for a support case. The processing services on Heroku do not store any customer data: they return their results immediately and then discard the data.

This is why attestations for service organizations – IDW PS 951 in Germany, ISAE 3402 internationally, SOC 1 in the US – do not apply to JustOn. They assess the internal control system of a provider who runs processes relevant to financial reporting for its customers. With JustOn, the customer runs these processes in its own environment.

Platform Security

Both Salesforce Platform and Heroku are subject to comprehensive compliance audits. They verifiably comply with multiple certifications, standards and regulations, including ISO 27001, SOC 1, SOC 2 and PCI DSS. As JustOn software is developed using the features provided by Salesforce Platform and Heroku, it relies on their security mechanisms, like user authentication and permissions.

Salesforce publishes the current certificates and audit reports on its compliance portal:

• Compliance | Salesforce Certifications
• Compliance | Heroku and Heroku and compliance

The current availability of the Salesforce services and data centers is shown on Salesforce Trust. For details, see Availability and Operational Security.

JustOn Certifications and Attestations

JustOn's own certifications and attestations confirm that the software supports proper, compliant work. They refer to the software and JustOn's development process – the customer remains responsible for how it uses the software.

NF203

JustOn Billing & Invoice Management has been certified according to the French Certification Rules NF Logiciel (NF203) and the ISO/IEC 25051:2014 standard since 2021. AFNOR Certification awards the certification, INFOCERT audits it annually. The audit covers, among other things, immutability, traceability and archiving, as well as JustOn's development and release process.

The current status is listed in the public INFOCERT register: certificates.infocert.org.

For how to set up JustOn Billing & Invoice Management for NF203 compliance, see NF203 – Guide de conformité FR. For how to print the certification to invoice PDFs, see Controlling Certifications Display.

IDW PS 880

In 2017, an auditing firm audited JustOn Billing & Invoice Management according to IDW PS 880, the German auditing standard for software products. The auditor attested that the software, when used properly, enables accounting in accordance with the German principles of proper accounting, expressly taking into account the GoBD.

The audit covered the version current at that time. The current versions are audited annually by INFOCERT as part of the NF203 certification.

GoBD Process Documentation

There is no certificate for GoBD compliance. What the GoBD require from the software – immutability, traceability, logging and retention – is described in the process documentation for JustOn Billing & Invoice Management. Customers can use it as a building block for their own process documentation:

• JustOn Billing & Invoice Management: GoBD-Konformität DE
• Accounting Standard Compliance (English version)
• JustOn Connector for DATEV – GoBD-Konformität DE

SOC 2 Type 2

As evidence of its own information security, JustOn is undergoing a SOC 2 Type 2 audit. The report is expected by the end of 2026.

Salesforce Security Review

In order to be distributed and operated on the Salesforce platforms, JustOn software must undergo regular security reviews. The Salesforce security reviews test the security of the software, including how well it protects customer data. As long as JustOn software is available on Salesforce AppExchange, it has successfully passed the security reviews. This applies to all JustOn apps.

Typical Requests

Requests for evidence often come as a checklist of certificates. The following table shows what applies to JustOn.

NF203 and IDW PS 880 cover JustOn Billing & Invoice Management only. For all other JustOn apps, like JustOn Cash Management, the platform certifications and the Salesforce security review apply.

If you need evidence that is not listed here, contact us.

Further Information