Your company's data stays your company's
- Each company is a separate tenant. Every request is limited to the signed-in user's own company.
- Automated tests check that one company cannot read or change another company's records, on every change to the code.
- The application servers and the database are in India.
Sign-in and sessions
- All traffic is encrypted with HTTPS, and browsers are told to use HTTPS only.
- Passwords are stored hashed, never in plain text, and must meet a minimum strength.
- Repeated failed sign-in attempts are limited per account and per network address.
- Signing out ends the session on the server, not only in the browser.
- When a password is reset or changed by an admin, sessions signed in before the change stop working.
Access inside your company
- Your company admin sets each user's permissions module by module: view, add, edit, delete and approve.
- Changes to records are written to an audit log.
Certifications
CCTV ERP Lite does not hold a security certification such as ISO/IEC 27001 or SOC 2, and we do not claim one. The controls above are checked by automated tests that run on every change.
Reporting a security problem
If you find a security problem, email [email protected]. Please do not test against other companies' accounts. How we handle personal data is set out in the Privacy Policy.