Two-factor authentication
Standard time-based one-time passwords, enrolled by scanning a QR code into any authenticator app. The challenge expires after five minutes and locks after five failed attempts.
Security
Built for a system that holds your commercial terms and your payroll.
Everything below already exists in the software. None of it is an add-on, a paid tier, or something that arrives in a later version.
Getting in
Three independent gates, each one optional, each one enforced on the server rather than in the browser.
Trusted devices
A user can mark their own machine as trusted and skip the second factor on it, without weakening the requirement anywhere else.
Administrator-approved devices
Switched on per user, a new browser must be approved by an administrator before that person can sign in from it at all. Approvals can be revoked later.
Login alerts
Sign-ins raise an email to a nominated mailbox, so an unexpected session is noticed the same day rather than at the next audit.
Sessions that expire
Thirty minutes idle and the session ends, enforced at both ends, with a keep-alive heartbeat so active work is never interrupted mid-form.
Who can do what
Not three tiers of user. Five independent rights on each module, for each role, plus the tabs inside it.
Five rights per module
Show in menu, view, add, edit and delete are set separately. A role can be allowed to create purchase orders and never to delete one, and the menu can be hidden without the data being reachable underneath.
Tabs hide individually
Within a module a role can otherwise see, specific tabs are hideable — so an HR role reaches employees and attendance but not advances and loans.
Unlimited custom roles
The nine seeded roles are a starting point. Create your own with its own name, tag and colour; only the super administrator role is locked from editing.
Checked twice, trusted once
The interface hides what a role cannot use, and every request is independently authorised on the server before it runs. The browser is never the thing enforcing access.
A named editing authority
One nominated role — chosen by you, not hardcoded — may edit an already-approved quotation, invoice or purchase order. Everyone else raises an edit request instead.
What happened to the data
Changes are recorded, deletions are reversible, and secrets are not sitting in the database in the clear.
Audit log with before and after
Actions are written with the user, the module, the record, the old values and the new values, and the originating IP address — surfaced as a searchable activity report.
Every session logged
Login and logout with IP, browser, duration, and whether the session ended manually, timed out, or was forced.
Soft delete and restore
Deleting hides a record and stamps who did it. An administrator can restore it intact or purge it permanently; ordinary users never see deleted rows at all.
Secrets encrypted at rest
Mailbox passwords, Google credentials and authenticator seeds are stored encrypted, not as readable text.
Uploads that are what they claim
Attachments are size-capped and checked by inspecting the file itself, not by trusting its extension, and sensitive upload directories are blocked from direct web access.
Where it runs
One company, one database, your server. There is no shared tenancy and no vendor cloud in the path.
Single tenant by design
Each deployment is one company on its own database. Your records are not co-located with anyone else’s, because the system has no concept of another tenant.
Your infrastructure
It installs on hosting you control. Commercial terms, customer data and employee records stay inside your own boundary.
Your mail server, not ours
Email goes out over your own SMTP, and the in-app client reads your own IMAP. No third-party sending service sits between you and your correspondents.
Hardened in the browser too
A strict content security policy, framing and MIME-sniffing protections, and a restrictive permissions policy ship with the application rather than being left to the host.
Parameterised throughout
Database access uses prepared statements with emulation off, across the whole application — not selectively where someone remembered.
What a role is
Five switches per module, not one tick-box.
A role is not a tier. For every module you decide separately whether it shows in the menu and whether that role may view, add, edit or delete — and inside a module you can hide individual tabs. So an HR role can open employees and attendance and never see advances and loans.
These nine roles ship configured out of the box. Everything past them is yours to define.
- Super Admin
- Purchase Officer
- Sales Officer
- Accounts / Finance
- HR Manager
- Store / Warehouse
- Production Supervisor
- Delivery Manager
- Management / Viewer
Want your security team to look at it first?
Reasonable. It runs on your own server, so they can review the deployment, the access model and the audit trail before a single record goes in.