Security & privacy

Real controls, described precisely

This page describes what runs in the platform today, as it is. If something is not implemented, it is not written here.

Identity and sessions

Google sign-in with email verification and a single-use challenge.
Employee accounts with a company code and username. Passwords are stored as salted scrypt hashes and are never sent or logged.
Optional two-step verification with an authenticator app (TOTP) and recovery codes, mandatory for platform administrators.
Temporary lockout after repeated failed sign-ins, with uniform errors that do not reveal whether an account exists.
HttpOnly, SameSite=Strict session cookies, Secure over HTTPS, unreadable by JavaScript.
Sessions end after 2 hours of inactivity or 8 hours at most, and you can end your other sessions from the account security page.
A CSRF token is required for every write, and cross-origin writes are rejected.
Rate limits on sign-in endpoints reduce guessing attempts.

The server — not just the interface — checks company membership on every request.
Ready-made and custom roles with granular permissions per module and action, checked by the server on every request.
No employee can grant permissions they do not hold or change their own access, and the owner account is protected.
A new company workspace requires approval by the platform team; there is no automatic activation.
A tamper-resistant security log records sign-ins, permission changes and administrative actions.
In local deployments each company has its own database.
Private chats are visible only to their two participants and are excluded from company exports.

Invoices and production post in a single transaction: all of it completes or nothing changes.
Stock can never become negative.
A per-request identifier stops the same invoice being posted twice on resubmission.
An audit trail records key operations with who performed them and when.

A Content Security Policy allows code to run only from the platform’s own origin.
Production mode requires HTTPS and disables demo sign-in.
The cloud database connection uses TLS with server certificate verification.
Credentials stay in server environment variables and are never sent to the browser.

We do not currently claim any compliance certification such as ISO 27001 or SOC 2.
We do not offer end-to-end encryption.
We do not offer an uptime guarantee.
Where data is stored depends on the deployment agreed with each company.
Email delivery is not configured yet: activation and password-reset links are handed over manually by an administrator through a trusted channel.

If an independent audit or certification is completed, we will publish its details and source here.