Security
Security is an architecture decision, not a checkbox.
How MyERPZ is built to protect your organization's data — described as design, because that is what it is.
On certifications
We do not currently hold third-party security certifications, and we do not claim any. We will publish them here when they are formally achieved. If your procurement process needs a security questionnaire completed, talk to our team and we will answer it directly.
Controls
How the platform is built
Authentication
Users authenticate against their organization. Credentials are stored hashed, never in plain text, and sessions are issued per device.
Authorization
Every request is authorised server side against the acting user. The interface hiding a control is never the security boundary.
Role-based access control
Permissions are granted through roles rather than assigned per user, so access can be reviewed and revoked at the role level.
Organization isolation
Data is scoped to an organization. Isolation is enforced in the database layer using PostgreSQL row-level security, not only in application code.
Data protection
Traffic is encrypted in transit with TLS. Data at rest is encrypted at the storage layer.
Audit logs
Significant actions — record changes, permission changes, exports — are recorded with the acting user and a timestamp.
Secure APIs
API endpoints authenticate and authorise every call, validate input, and apply the same organization scoping as the interface.
Session management
Sessions expire, can be revoked, and are invalidated on password change.
Backups
Data is backed up on a regular schedule with restores tested rather than assumed.
Infrastructure
Services run on managed infrastructure with restricted network access and least-privilege service accounts.
AI and your data
AI never bypasses authorization
If a user cannot access a record through the application, the AI assistant must not expose it. That is a hard rule in the architecture, not a guideline.
- Organization
- User
- Role
- Permissions
- Data access
- AI context
Sensitive actions require a person
AI can prepare or recommend these operations. It is designed not to execute them without explicit confirmation from someone authorised to perform them, and every such action is recorded in the audit log.
- Delete customer
- Delete lead
- Delete payment record
- Cancel booking
- Send bulk communication
- Export customer data
Need a security review?
We will walk your team through the architecture and complete your security questionnaire.