Epicor Cloud for Prophet 21

Epicor Cloud is Epicor's own hosting option for Prophet 21, run on Microsoft Azure. Epicor calls the architecture premium multitenant. Each distributor gets a dedicated Prophet 21 instance and its own SQL database. Shared services sit underneath that. Epicor provisions and manages the environment inside its own Azure subscription. A distributor is not managing Azure resources directly the way a self-hosted deployment would.

This is different from a distributor or a hosting partner running Prophet 21 on Azure or AWS independently. That kind of third-party cloud hosting still counts as on-premises for Epicor's purposes. It is covered in more detail below. Only Epicor's own product is Epicor Cloud.

Prophet 21 can run in three different places today. Those are a distributor's own on-premises servers, Azure or AWS through a third-party hosting provider, or Epicor Cloud, Epicor's own managed offering. Only the third option is what Epicor means by Epicor Cloud.

That distinction matters because of Epicor's on-premises sunset. Epicor has set 2028.1, expected in May 2028, as the final on-premises feature release of Prophet 21. Active support continues through June 30, 2029. That support covers security updates, critical patches, and compliance updates. After that date, on-premises installations move to sustaining support only. There are no new releases, no security updates, no compliance updates, and limited phone support. See Epicor's announcement ↗

That sunset applies to perpetual license holders. It also applies to distributors hosted by unaffiliated providers, including Azure or AWS. Running Prophet 21 on Azure through a third party does not escape the deadline. Only migrating to Epicor's own Cloud product does. After 2028.1, new Prophet 21 functionality ships to Epicor Cloud only.

This is the single biggest practical difference between on-premises Prophet 21 and Epicor Cloud. On-premises, direct SQL access to the database covers both reads and writes. That access has been the normal integration path for most of P21's history. On Epicor Cloud, a distributor gets a separate read-only copy of the production database for queries. It is kept in close sync but is not the live database itself. Anything that needs to write data has to go through Epicor's API layer instead.

That API layer is not one API but several, each built for a different job. The Transaction API handles bulk creation and updates of transactional data like orders and jobs. The Entity API works on specific records one at a time, with asynchronous calls for longer operations. The Interactive API is the only stateful option. It maintains session context the way a logged-in user would, rather than treating each call as independent. That lets it exercise the same screen-level and DynaChange rules a real user session would trigger. The other APIs already run their own validation through Epicor's service layer; Interactive adds the session-level layer on top of that. The Data Services API is read-only, built for reporting and data exports, with performance described as close to native SQL. DynaChange and Web Visual Rules have their own separate SDKs, for the no-code customization layer itself rather than day-to-day data access.

For integrations built around direct SQL access, moving to the cloud means rebuilding on whichever API actually fits the job. That is not always possible with the exact same tool. One documented case is VSIFax, a fax integration utility. It is not supported at all on cloud P21. In that case, the fix was a different product from the same vendor. Cases like it are concentrated in distributors that have been on P21 the longest and accumulated the most custom code.

Epicor states that Prophet 21 in the cloud has SOC 1 and SOC 2 Type II compliance reports available to customers on request, produced through annual third-party audits. Epicor also states it uses independent, certified third parties for routine cloud system testing, including regular vulnerability scanning and penetration testing. Azure itself is the underlying infrastructure. It supports a broad range of compliance standards, including HIPAA and ISO 27001. That is a statement about the platform Epicor builds on, not a P21-specific certification claim on its own.

Public materials describe high availability and built-in disaster recovery in general terms. No specific uptime percentage, recovery time objective, or recovery point objective appears in them.

How long migration takes depends on how customized the existing installation is. Reported timelines run six months to a year for a standard configuration, and one to two years for installs with heavy customization. Specific migration guidance for a given distributor typically comes through Epicor's own account team or an implementation partner. There is no single fixed public playbook.

Client-side hardware is worth planning for too. One documented case on the Epicor User Help Forum, a community-run site, describes a distributor that hit performance problems on cloud P21. They had to upgrade front-counter machines to more powerful processors, with solid-state drives and more memory. Even after the upgrade, the cloud version ran slower than their prior on-premises setup. Users pointed to the browser-based interface redrawing pages as the likely cause, rather than raw network bandwidth.

Epicor runs and maintains the servers on Epicor Cloud. Updates, patches, and new features roll out on Epicor's schedule, not a distributor's own IT team's schedule. Epicor describes the Cloud product as where it concentrates future Prophet 21 innovation.