Status
Owner	CABELLO MARTOS-ext, Gabino
Stakeholders	The business stakeholders involved in making, reviewing, and endorsing this decision. Type @ to mention people by name
LeanIX Link	Icertis Contract Intelligence

Introduction

Scope & Objectives

The purpose of this document is to describe the architecture of Icertis Contract Intelligence application and the systems it will be integrating with.

Out of Scope:

Since Icertis is a SaaS application, network and infrastructure architecture will be considered as out of Scope.
Information related to product documentation can be found online will not be documented here, but referenced using hyperlinks.

Key Decisions and Requirements

Description	Rationale
Single Sign-On (SSO)	As part of SyWay project, a common authentication mechanism (e.g., SAML) is adopted for ease of access and unified user experience.
Users must access Icertis using HTTPS.	As part of SyWay standards, all data in transit must be encrypted.
Data stored in Icertis must be encrypted.	As part of SyWay standards, all data at rest to be encrypted.
Icertis must have appropriate data protection.	Icertis performs data backups regularly so that point in time recovery can perform to recover data. Additional, backups must be replicated to another site to protect against a site disaster.

Terminology

To provide context for application specific terminology.

Application Architecture

Overview

Application Architecture Components

Icertis Contract Intelligence

Icertis is a contract lifecycle management (CLM) platform that helps organizations manage contracts digitally from creation to execution and compliance. It’s widely used by enterprises to improve visibility, reduce risk, and ensure compliance across all types of contracts.The "Ariba connector for Icertis" refers to the Icertis Contract Intelligence (ICI) for SAP Ariba integration, which extends SAP Ariba's procurement capabilities with Icertis's advanced contract lifecycle management (CLM) features. This integration synchronizes data between the two platforms, allowing users to manage contracts from sourcing through to payment, leveraging AI and automation for tasks like contract authoring, risk assessment, and compliance tracking.

SyWay Project > Application Architecture Icertis > image-2025-11-18_20-48-54.png

Ariba Connector for Icertis

The SAP Ariba Connector for Icertis is a packaged, API‑based integration that unifies SAP Ariba sourcing & contracting workflows with Icertis Contract Intelligence (ICI). It enables pre‑signature authoring and negotiation in Icertis, and post‑signature contract usage, compliance and visibility in SAP Ariba—so contract data and documents flow reliably across the source‑to‑pay lifecycle.

Network Architecture

Optional Section if application requires a network design.

System Landscape

ICertis will consist of a three tier landscape.

Application	Region	SBX	DEV	INT	UAT	PAR	TRG	PROD
ICertis	EU	-	DEV			Test	DEV	PRD
ICertis	US	-	-	Test				PRD

Application Security

User Access

Icertis is a SaaS application and can be accessed by users over the internet via HTTPS using their web browser. No Syensqo infrastructure or application is required to access Icertis.

User must have their IDs created and assigned with the correct role before they can login to Icertis.

Following are the URLs for Icertis instances:

Development: https://syensqo-dev.icertis.com/
Test: To be provisioned
Production: https://syensqo.icertis.com/

Authentication

Icertis is configured to perform SAML SSO with Syensqo Entra ID. The use of SSO is mandatorily enforced via configuration, and users cannot bypass SSO to log in with a password.

Authorization

Standard Single - Tenant deployment with access restrictions using ICI Authorisation Model

ICertis Contract Intelligence (ICI) will be deployed in Single Tenant (ST) Deployment model in a region aligned to the rest of the landscape.

SyWay Project > Application Architecture Icertis > Security Approach Diagrams-ICertis.drawio.png

Every Syensqo user will be assigned a position in the organisation at that node of the hierarchy, or at nodes below that node. Syensqo can configure region-specific Org Units.

Authorisations in ICertis will be driven by Org structure, Security Groups configured by Syensqo.

All data and all contract documents will be stored in same deployed region, but users will access it based on their permission assigned. For example, China users will have access to only those contracts which are under “China Org”, However US Legal can have access to contracts for US as well as China.

Communication Security

For data in transit encryption, communication is secured using SSL/TLS (TLS 1.2+) encryption, and weak ciphers are disabled.

Data Security

Uses TLS/HTTPS for communication and AES encryption for stored data. Supports double encryption and customer-managed keys (CMK) via Azure Key Vault.
Maintains ISO 27001, SOC 1/2, PCI DSS, HIPAA, and GDPR certifications through cloud provider (Azure) and internal policies.
For data at rest encryption, features provided by underlying Azure services are used, e.g., TDE for SQL DB, SSE for BLOB storage, and so on. Industry-standard algorithms like AES 256 bit are used for encryption.everages Azure’s certifications—ISO, SOC, NIST, FedRAMP, EU Data Boundary—for regulated workloads.
By default, data at rest encryption is enabled with the Microsoft managed keys. Where a customer has requested Icertis managed keys for data at rest encryption, Icertis uses Azure Key Vault (AKV) for storing and managing the encryption keys.

Other Controls

Icertis is covered by standard availability SLA for SAP Cloud Services - 99.7%
Icertis Contract Intelligence platform (ICI), is hosted primarily on the Microsoft Azure cloud, where Icertis owns the cloud subscription. Icertis security and compliance team ensures
that Icertis operations handle customer data hosted on the Microsoft Azure cloud with all best practices.
Icertis implements the following industry-standard information security frameworks to assure data confidentiality, integrity, availability,and privacy:

SyWay Project > Application Architecture Icertis > image-2025-11-18_20-18-57.png

Operation Architecture

Change and Configuration Management

Please refer to document DD-TEC-170 Transport Management for Release 4. See below information from referenced document:

ICertis is a brownfield system and will be support by SyWay project team. A shared landscape strategy will be adopted for ICertis where both support and project team will use the same landscape.

Landscape

ICertis will consist of a three tier landscape.

DEV	Build	Build, Integration Test, UAT
QAS	Test & UAT	Regression Test (during Parallel Run)
PRD	Production	Cut-Over

US ICertis Tenant details are not included.

Transport Path

Configurations and changes will be performed in development and transported to QAS & Production instances.

Transport Approach

Promote Configurations (P2P) Tool will be used to transport changes from non-production systems to Production.

Monitoring

Icertis system availability can be monitored via Icertis Trust Center.
All Icertis internal critical servers and systems are configured to log general activities. This includes auditing of events on critical Windows systems such as successful logons, unsuccessfullogons, access file rights successes or failures, privilege modifications, etc. The logs are maintained in the Centralized Syslog Server for 90 days.
Event logs generated by ICI platform are stored for up to 30 days. Security event logs captured from Azure infrastructure are maintained in Microsoft Sentinel SIEM for up to 90 days.
Icertis has implemented ‘Microsoft Defender for Cloud’ for security management and threat protection of user entity instances on the Microsoft Azure platform.
A Microsoft system monitoring tool is utilized to identify availability issues or concerns with metrics such as server load alert, SQL Database Transaction Unit (DTU) utilization, failed Azure activity logs, free disk space, high disk utilization, etc. through alerts. Alerts are configured by the Cloud Operations team for each user entity instance on the Microsoft Azure platform. The Cloud Operations team receives email alerts for any breach in utilization threshold. The Cloud Operations team analyzes the alerts and if necessary, raises an incident ticket within the Freshdesk/ ServiceNow ticketing tool and takes corrective actions.
All application-level logs are stored in the Azure SQL database, and they are encrypted at rest using TDE.

Sizing

Provide the details of sizing approach and the future recommendations

High Availability & Disaster Recovery

Icertis is deployed across multiple availability zones with the following SLA:

RPO - 24h
RTO - 8h

Backup/Restore

For customer data, Incremental backup is performed every 24 hours. Full back-up is performed once aweek during a pre-defined maintenance window. Backups are stored on geo-replicated Azure storage.
Restoration of normal network operations is the final goal of any security violation response. Normal backups are available by contacting the IT team.

Maintenance Plan

Provide the details of system and application maintenance plan. This should follow the upgrade strategy

Exceptions

This section covers any exceptions to the reference architecture. Some Applications may have limitations and may not meet the Enterprise Architecture, Reference Architecture and IT Policy guidelines. All exceptions should be included in this section.