Here is an accurate description of the controls in the MultiERP platform today and the improvements that are planned. We do not claim certifications we have not obtained.
Available
Authentication
Accounts are protected with modern password hashing and secure sessions.
Argon2id password hashing
HttpOnly, Secure session cookies with absolute and idle expiry
Email verification before first sign-in
Single-use, time-limited password reset links
Rate limiting on sign-in, sign-up and email actions
Available
Tenant data isolation
Each organization's data is separated at several layers of the application.
Organization membership verified on every request
Records always looked up within the verified organization
Data access layer scopes queries to the organization automatically
Automated tests that check one organization cannot reach another's data
Available
Role-based permissions
Five roles define what each member can do, and the server enforces them.
Owner, Admin, Manager, Member and Viewer roles
Permissions checked on the server for every action
Roles can only be granted below your own
The last owner of an organization is protected
Available
Audit logging
Sensitive actions are recorded in an append-only log that cannot be edited.
Sign-ins, sign-outs and failed attempts
Invitations, role and membership changes
Application install, activation and removal
Sensitive values redacted before storage
Available
Secure production configuration
The production environment is configured to reduce exposure.
HTTPS with HSTS
Content Security Policy and other security headers
Internal services not exposed to the internet
Automated daily database backups with verification
Available
Administrative controls
Platform-level administration is separate from organization roles.
Platform Super Admin role granted only from the server
Re-authentication required for sensitive changes
Owner-only, password-confirmed data deletion
Available
Controlled registration
Public sign-up is disabled by default. Accounts are created through invitations or by our team.
Registration controlled by platform administrators
Invitation-only account creation by default
Blocked sign-up attempts are audited
Planned security improvements
Planned
Multi-factor authentication (TOTP) with recovery codes, and passkeys
Database-level row security as an additional isolation layer
Audit log export and retention policies
Alerts for suspicious sign-in patterns
Checks against known breached passwords
MultiERP does not currently hold third-party security certifications, and this page does not claim compliance with any specific regulation. If your organization has specific requirements, our team will discuss them with you openly.
Let's discuss what your business needs
Tell us about your organization. Our team will get back to you to arrange a conversation or a guided demo.