---
title: "NetSuite integration security: is an AR tool safe to add?"
description: "NetSuite roles, OAuth 2.0 and SOC 2 for an AR tool: what permissions to give, what to ask the vendor, and what Paidnice can and cannot show."
url: https://www.paidnice.com/blog/netsuite-ar-integration-security
---

# NetSuite integration security: is an AR tool safe to add?

Written by Jack Daffron Co-founder of Paidnice

Reviewed by Ashley Schroder Co-founder of Paidnice

Published Oct 27, 2026 · 11 min read Expert verified

## Summary

You can connect an AR tool to NetSuite safely if you give it a dedicated integration role with only the permissions it needs, ask which sign-in method it uses, and read the vendor's assurance reports. Paidnice is not SOC 2 or ISO 27001 certified; it offers annual penetration test reports and a written security review instead.

- **Role:** A dedicated integration employee and a custom role, not an administrator. Give it REST Web Services access and only the records the tool uses.
- **Sign-in:** Oracle closes SOAP to new integrations from 2027.1 and turns SOAP off in 2028.2, and prefers OAuth 2.0 for REST. Ask any vendor which method it uses and when its secrets expire.
- **Assurance:** Ask for SOC 2 Type II, its scope and the customer's own controls. For Paidnice, ask for the annual penetration test reports: no critical or high findings.
- **Data:** Ask where the vendor stores your customers' data, who its sub-processors are and whether a data processing addendum applies.

Paidnice connects to your ERP on the Custom plan. [Book a demo on your own data](https://www.paidnice.com/book-a-demo), and a specialist sets up the connection.

Your IT lead asks one question about the AR tool: what can it see in NetSuite, and who vouches for the vendor? You have a vendor security form open and a NetSuite role list in the next tab.

This page answers both. It covers the role an AR tool needs, why the sign-in method matters, what to ask any vendor, and what Paidnice can and cannot show. For how the tools compare, see our guide to [credit control software for NetSuite](https://www.paidnice.com/blog/credit-control-software-netsuite).

## What permissions does an AR tool need in NetSuite?

An AR tool needs a dedicated integration user and a custom role with REST Web Services access plus read or write on only the records it uses, such as customers, invoices, payments and notes.

Two setup permissions make REST access work: **REST Web Services** and **Log in using OAuth 2.0 Access Tokens**, both at Full.

Record permissions depend on what the tool reads and writes. Oracle does not publish an exact least-privilege set for a collections tool, so ask the vendor for its list.

A collections tool works with customer and invoice records. It has no reason to touch vendor records or vendor bank details, so leave those off the role. Workato also advises against giving the integration user the Access Token Management permission. On OneWorld, the role needs access to each subsidiary the tool reads.

IP address rules are set at company level (Setup > Company > Company Information > IP Address Rules) and enforced per role with the role's Restrict this role by IP address box, so you can limit the integration role to the vendor's addresses. Integrations that sign in with tokens or OAuth are non-interactive, so they typically sit outside the two-factor rules for people.

Review the integration role with your other roles at least once a quarter: who holds it, which permissions it has gained, and whether its tokens or certificates still have an owner.

Every account has an integration concurrency limit set by service tier: 5 on Standard, 15 on Premium and 20 on Enterprise and Ultimate, and each SuiteCloud Plus license, sold separately, adds 10 ([Oracle, SuiteCloud Plus Settings table](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N259503.html)). Web services and RESTlets share that cap, so a tool that polls too hard uses slots your other integrations need.

Paidnice runs a small number of requests at a time, reads only changed records, and backs off and retries when NetSuite returns a concurrency error, so it does not crowd out your other integrations.

### The integration role checklist

| Setting | Why | Source |
| --- | --- | --- |
| Dedicated integration employee | Its activity shows in the audit trail on its own, and leaving staff do not take the connection with them. Name it so it reads as an integration, such as "Integration - AR tool", not as a person | Oracle token setup; Stripe's NetSuite guide |
| Custom role, not Administrator | An administrator role can read and change everything, including vendor bank details | Oracle; practice shared by integration vendors |
| REST Web Services permission | Lets the role call the REST API at all | Vendor connection guides |
| Log in using OAuth 2.0 Access Tokens | Lets the role sign in with the method Oracle prefers for REST | Vendor connection guides |
| Record permissions for the records the tool uses | For Paidnice: Lists: Customers (Edit, for notes and custom fields), Contacts (View), Items, Subsidiaries, Currency, Accounting Lists and Tax Records (View), Notes Tab (Create). Transactions: Invoice (Create, for late fee invoices), Customer Payment (View), Credit Memo (View). Setup: REST Web Services, Log in using OAuth 2.0 Access Tokens. Accessible Subsidiaries: the subsidiaries you include, on OneWorld. Nothing on the vendor side | Derived from the tool's job |
| No Access Token Management permission | Stops the integration user creating tokens for other roles | Workato connection guide |
| IP restriction on the role | Limits the sign-in to the vendor's addresses | NetSuite IP restriction setting |
| Non-interactive role | Tick **Web Services Only Role** on the integration role (Setup > Users/Roles > Manage Roles). It blocks UI login for that role; it does not block other non-UI routes, so keep the permission list short | [Oracle, Web Services Only Role](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/bridgehead_N288629.html) |
| Log review | Put the integration user's login audit trail in your regular access review, with your human users | Derived from the dedicated-employee setup above |

Oracle's concurrency tiers are in its [SuiteCloud Plus Settings table](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_N259503.html); the role setup steps are in its OAuth 2.0 and token documentation. The steps are typical for any external tool.

![NetSuite integration role: an integration user only, a custom role instead of Administrator, OAuth 2.0 for REST](https://www.paidnice.com/images/blog/netsuite-ar-integration-security-card.png)

Free: Payment reminder email templatesCopy the reminder emails for before, on and after the due date.

## Why OAuth 2.0 and not token-based authentication?

Oracle closes SOAP to new integrations from 2027.1 and disables all SOAP endpoints in 2028.2, and prefers OAuth 2.0 for REST, so ask any vendor which sign-in method it uses and when it expires.

Oracle's [SOAP end-of-life timeline](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/article_2104046421.html) sets four dates. Release 2025.2 is the last planned SOAP endpoint.

From 2027.1, no new integrations may be built with token-based authentication or SOAP. From 2027.2, only the 2025.2 endpoint is supported. In 2028.2, every SOAP endpoint is switched off.

For REST, Oracle prefers OAuth 2.0, and existing REST integrations on token-based authentication keep running. Oracle's FAQ is clear for SOAP. Some integration vendors, including Workato, read the 2027.1 cutoff to cover REST and RESTlets as well. Treat that as the vendor's reading, and ask your Oracle account manager if it matters to your plan.

> Oracle's own words: "With the 2027.1 release, you will not be able to build any new integrations using Token Based Authentication (TBA), which is required for SOAP web services." And: "only new integrations must use OAuth 2.0, starting with the 2027.1 NetSuite release."

New Paidnice connections sign in with OAuth 2.0 client credentials over REST, the method Oracle names for new integrations from 2027.1.

Machine-to-machine OAuth 2.0 in NetSuite pairs an integration record with a certificate key pair. Oracle caps that certificate at two years of validity and shortens a longer one to two years ([Oracle, certificate conditions](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/subsect_162755332391.html)), so renewal is a dated event: ask who owns the date. For Paidnice, the renewal date is agreed at implementation and goes in both calendars.

| Method | New integrations | Existing REST integrations | Credential |
| --- | --- | --- | --- |
| Token-based authentication | Blocked from 2027.1 for SOAP; Oracle's text names SOAP, some vendors read it to cover REST too | Keep running, per Oracle | Token key and secret tied to an employee and a role |
| OAuth 2.0 | Oracle's preferred method for REST | Not affected | Certificate key pair on the integration record, valid for at most two years |

## What should we ask the vendor before we connect?

Ask the vendor eight things: which role and permissions, which sign-in method, where data is stored, who can see it, which reports prove it, how fast it patches, how it handles sync failures, and what happens when you leave.

The checklist below is the vendor security form rewritten for an AR tool on NetSuite. Where a Paidnice cell reads "Ask in the security review", the answer is given in the review itself.

Some vendors show a "Built for NetSuite" badge. It means the vendor answered Oracle's questionnaire and gave a demo or references, and must renew it for major releases. Oracle gives no guarantee with it, so read the vendor's own assurance reports as well.

### The vendor questionnaire, with Paidnice's answers

| Area | Question to ask | A good answer | Paidnice answer |
| --- | --- | --- | --- |
| Access | Which NetSuite role and permissions do you need? | A named list on a custom role, never Administrator | A dedicated employee record and a dedicated role, never Administrator. The permission list is sent as a table before the security call |
| Access | Which records do you read and which do you write? | Specific record types | Reads customers, contacts, invoices, Customer Payments, Credit Memos and the custom fields you map. Writes new invoices for late fees (Pending Approval or Open) and User Notes for call summaries, and custom fields sync both ways. Every record it creates carries a Paidnice External ID |
| Authentication | OAuth 2.0 or token-based authentication, and when do secrets or certificates expire? | A named method, a named expiry date and a named owner | SuiteTalk REST with OAuth 2.0 client credentials for new connections. The certificate is valid for at most two years, and the renewal date is agreed at implementation |
| Authentication | Does your own app support single sign-on and roles for my team? | Yes, with role limits | Microsoft Entra ID, Okta, Google Workspace, SAML 2.0 and OIDC on the Custom plan. Role-based access, with contacts or groups assigned to named team members |
| Data | Where is data stored? | A named region | United States, on Google Cloud |
| Data | Who are your sub-processors? | A public list | See [sub-processors](https://www.paidnice.com/sub-processors) |
| Data | Is data encrypted at rest? | Yes, with the standard named | Yes, AES-256 |
| Data | Do you train AI models on my data? | No | Ask in the security review |
| Assurance | Do you have SOC 2 Type II or ISO 27001? | A current report, or a plain no | Paidnice is not SOC 2 or ISO 27001 certified; Google Cloud holds ISO 27001 and SOC 1/2/3 |
| Assurance | Independent penetration tests? | Annual, reports on request | Annual independent penetration tests, no critical or high findings, reports on request |
| Assurance | Which controls do I need to run on my side? | A list | The role setup above: a dedicated employee and role, Web Services Only Role ticked, the permission list we send, and the integration user in your access review |
| Operations | What happens when a sync fails or a payment duplicates? | A defined behavior | Every record Paidnice creates carries a Paidnice reference in the External ID field and is checked before any retry, so nothing posts twice. A failed write is retried, then flagged in Paidnice and emailed to your team, and the chase on that invoice pauses until it is fixed |
| Operations | How do you handle NetSuite's two releases a year and the 2027 sign-in changes? | A named process | New connections sign in with OAuth 2.0 client credentials over REST, the method Oracle names for new integrations from 2027.1. Release testing: ask in the security review |
| Exit | How is access revoked and data deleted? | Immediate revoke, deletion on request | Set the Paidnice integration record to Blocked, or revoke the certificate or token, and nothing is read or written until it is re-enabled. Deletion terms: ask in the security review |
| Incident | Do you have an incident response plan and notification terms? | Yes | Ask in the security review |

## Does the vendor have SOC 2?

Paidnice is not SOC 2 or ISO 27001 certified. Its hosting provider, Google Cloud, holds ISO 27001 and SOC 1/2/3; those certify the platform, not Paidnice's own controls.

Here is what Paidnice can show instead. Annual independent penetration tests, with no critical or high findings, and the reports are available on request. Two-factor authentication for customer accounts, and role-based permissions for your team.

On the Custom plan, single sign-on through Microsoft Entra ID, Okta or Google Workspace, using SAML 2.0 or OIDC. The full list is on our [security page](https://www.paidnice.com/security).

Some AR tools in this category publish SOC 2 Type II badges. Paidnice offers the penetration test reports and a written security review in their place.

When a vendor does hand you a SOC 2 report, read four parts. Type II covers a period; Type I covers one date. The scope says which systems were tested.

The exceptions list says where controls failed. The complementary user entity controls say what you must do on your side, such as the role setup above.

NetSuite's own SOC 1 and SOC 2 Type 2 reports and ISO 27001 cover Oracle's platform. They do not cover your role setup, your token handling or your integration list. Those are yours, whatever tool you connect.

## Where is my customers' data stored?

Ask the vendor where it stores your customers' data, who its sub-processors are and whether a data processing addendum applies.

A collections tool holds customer names, contact details, invoice amounts and payment history. For UK and Australian readers, the region matters for your own privacy obligations, so get the answer in writing. Paidnice publishes its [sub-processor list](https://www.paidnice.com/sub-processors) and offers a [data processing addendum](https://www.paidnice.com/dpa). Data is hosted in the United States on Google Cloud and encrypted at rest with AES-256.

If your AR tool takes card or bank payments through a portal, ask where those details go. In Paidnice, portal payments run through Stripe. Paidnice stores a Stripe reference, and card and bank details never reach Paidnice.

## How Paidnice connects to NetSuite

Paidnice connects to NetSuite on the Custom plan through SuiteTalk REST web services, under a dedicated employee record and a custom role with Web Services Only Role ticked. It follows the integration pattern NetSuite recommends: an integration record, a dedicated role and OAuth 2.0 sign-in, all set up in your account. New connections sign in with OAuth 2.0 client credentials, and the certificate is valid for at most two years.

An implementation specialist handles setup with your NetSuite administrator, and the permission list is sent as a table before the call. The plan is quoted for your setup.

Paidnice reads customers, contacts, invoices, Customer Payments, Credit Memos and the custom fields you map. It reads records changed since the last run, using each record's last modified date. On OneWorld the role has access to the subsidiaries you include.

Paidnice writes new invoices for late fees (Pending Approval or Open) and User Notes for call summaries, and custom fields sync both ways. Every record Paidnice creates carries a Paidnice External ID so nothing posts twice.

Paidnice also [reads each customer reply](https://www.paidnice.com/ai-collections-agent) and drafts the answer for a person to approve. Nothing runs until you approve the policy. For how roles and approvals work inside Paidnice, see [approvals](https://www.paidnice.com/approvals), and for role access across subsidiaries, see [credit control across multiple entities](https://www.paidnice.com/credit-control-multiple-entities).

To start the security review, read about [Paidnice for NetSuite](https://www.paidnice.com/integrations/netsuite) and ask for the penetration test reports when you book the demo. For who does what and how long it takes, see [what the setup plan looks like](https://www.paidnice.com/blog/netsuite-ar-automation-setup).

## NetSuite integration security: common questions

Short answers on whether a third-party collections tool is safe, Paidnice and SOC 2, single sign-on, NetSuite's API, team roles, two-factor rules and sandbox refreshes.

**Is it safe to connect a third-party collections tool to NetSuite?** It can be, if the tool uses a dedicated integration role with only the permissions it needs, tells you which sign-in method it uses and when it expires, and the vendor can show independent assurance. Use the questionnaire above.

**Does Paidnice have SOC 2?** Paidnice is not SOC 2 or ISO 27001 certified. Google Cloud holds ISO 27001 and SOC 1/2/3. Paidnice has annual independent penetration tests with no critical or high findings, and shares the reports on request.

**Can our team sign in to Paidnice with single sign-on?** Yes, on the Custom plan: Microsoft Entra ID, Okta, Google Workspace, or any SAML 2.0 or OIDC provider. It works with roles.

**Does NetSuite have an API for integrations?** Yes. NetSuite offers REST web services with OAuth 2.0, and SOAP web services that Oracle is retiring in stages to 2028.2.

**Can I limit what my own team sees in Paidnice?** Yes. Paidnice has role-based access, including a view-only role that cannot send or change anything. You can assign contacts or groups to named team members, limit a user to given entities or to their assigned customers, and route a junior user's sends to an approver first.

**Do two-factor sign-in rules apply to the integration?** Integrations that sign in with tokens or OAuth are non-interactive, so they typically sit outside the two-factor rules for people. The controls that matter are the role, the permission list and, where you set them, IP restrictions.

**What happens to the connection when NetSuite refreshes a sandbox?** A sandbox refresh deletes the sandbox token keys and secrets, so they must be created again. Production integration records copy into the sandbox, and Oracle advises reviewing and blocking the ones you do not use there. Production tokens are not affected.

## Paidnice features in this article

- [**Roles and approvals** Assigns accounts to people or an AI agent and asks for approval before each action.](https://www.paidnice.com/approvals)
- [**Credit control for multiple entities** Chases each company in a group in its own name, from its own address.](https://www.paidnice.com/credit-control-multiple-entities)
- [**AI collections agent** Answers customer replies and logs the dates customers promise to pay.](https://www.paidnice.com/ai-collections-agent)

## About the editorial team

Written by Jack Daffron Co-founder of Paidnice

Jack is a co-founder of Paidnice and has built accounting software for more than 10 years. He builds the product that sends reminders, adds late fees and takes payments for businesses on Xero, QuickBooks and ERPs such as NetSuite and Business Central.

Reviewed by Ashley Schroder Co-founder of Paidnice

Ashley is a co-founder and lead developer of Paidnice and has built accounting software for more than 10 years. He builds the ledger connections that put reminders, late fees and payments into Xero, QuickBooks and ERPs such as NetSuite and Business Central. Before Paidnice he co-founded A2X, ecommerce accounting software for Xero and QuickBooks.

### Try Our Free Accounts Receivable Calculators

Optimize your cash flow with our suite of financial tools designed for AR professionals. Calculate DSO, aging analysis, late fees, and more.

Explore Calculators

## Start getting paid on time with Paidnice

Paidnice is accounts receivable automation that enforces your payment terms. On the Custom plan it connects to your ERP, and a specialist sets it up after a demo.

Book a Demo

[Rated 5 stars, 160+ reviews](https://www.paidnice.com/reviews) · [App of the Year](https://www.paidnice.com/blog/winner-xero-global-app-awards-2026)