Security and resilience

How the service keeps your data safe and running. These screens are for the service provider; companies see the result on the public status page.

Two-step sign-in

Under Company settings > Branding and security, require two-step sign-in for every staff member.

Encryption keys

Passwords for mail and payment services, two-step sign-in secrets, connector and webhook secrets, AI keys and bank details are stored encrypted. Platform > Resilience > Rotate the encryption key encrypts all of them again with a new key; the old key is kept as a previous key so sessions and links already sent keep working.

Backups and drills

A backup is made every night at 02:15, sealed with encryption and checked with a checksum; the latest 14 are kept (set ERP_BACKUP_KEEP to change it). Once a month a restore drill opens the latest backup, restores it into a scratch database and counts every table against it. Both can be run at any time from Platform > Resilience.

Uptime

Every five minutes the database, file storage, background jobs, scheduled work, email and backups are checked. Platform > Resilience shows each part and its uptime over 30 days; /status shows it publicly.

Certification readiness

Platform > Certification readiness lists the ISO 27001 and SOC 2 controls an auditor asks about, what in the system meets each, the evidence and its owner. Controls the system can check itself (two-step sign-in, backups, drills, key rotation, audit trail...) are refreshed daily. Platform > Security findings tracks each finding from penetration tests and audits until it is fixed.

Limits

Readiness is not certification: an independent auditor must still assess the controls, and penetration testing must be done by an outside firm.