Security & trust

Your company runs on this data — CRM, finance, payroll, HR. Here's exactly how we protect it, in plain language. No jargon, no claims we can't back up.

Tenant isolation

Every workspace is a separate tenant. Data access is scoped to your tenant on the server for every read and write — enforced by the database key and the session, not by the browser. One customer can never see or modify another's records.

Encryption

All traffic is served over TLS (HTTPS) — data is encrypted in transit. Your data is stored in a managed Postgres database with encryption at rest provided by the database host.

Payments handled by Stripe

Billing runs through Stripe (PCI-DSS Level 1 certified). Card numbers are entered on Stripe's own checkout and never touch our servers — we only store your plan and a Stripe customer reference.

Your data is portable

Export your records to CSV from every module, any time. There's no lock-in — your business data belongs to you and leaves with you.

Authentication

Passwords are hashed with bcrypt, never stored in plain text. Sessions use signed, http-only cookies with a fixed expiry. Roles (owner / admin / manager / member) scope what each teammate can do.

Infrastructure

Hosted on Vercel's global edge network with a managed Postgres database. Automated platform-level backups and high availability are provided by our infrastructure hosts.

Subprocessors

The third parties we rely on to run the service, and what each one handles.

ProviderPurposeData involved
VercelApplication hosting & CDNApp traffic, request logs
Managed Postgres (Neon / Vercel Postgres)Primary databaseAll workspace records
StripeSubscription billingBilling email, plan, payment method (held by Stripe)

On our roadmap

We're honest about what isn't built yet. These are planned, not shipped — we'll update this page as each lands.

Found a security issue?

We take reports seriously. Email us and we'll respond quickly — responsible disclosure welcome.

security@erp-management.app
← Back to home