We don't bolt security on, it sits in the foundation
Vault, RBAC, audit logs, FIDO2, GDPR by default. You don't get 8 security add-ons, you get a platform built for it from day one.
Security doesn't belong on the last slide of a sales deck. It belongs in the code.
Server vault
AES-256-CTR. For credentials the server itself uses: OAuth tokens, Slack hooks, SMTP passwords. The server can decrypt them, you don't have to think about it.
End-to-end vault
PBKDF2-SHA256 with 600,000 iterations → AES-256-GCM. For data not even we should see. The key derives from your master password, the server only ever sees ciphertext.
Who sees what: RBAC with depth
Roles, rights and modules are three axes. You define roles ("site manager", "cashier", "marketing"), give them rights ("can view invoices", "can post hours"), and assign them to modules.
Every role is tenant-scoped. Staff in branch A see branch A. The group sees everything. ResellerResellerA reseller sells aYOUne on to their own customers under their own brand and prices. Like a dealer offering a product under their own name. customers see only their own data.
Audit logs as standard
Every sensitive action (login, data change, vault access, rights change) is logged immutably. When your data protection officer asks "who accessed customer Smith on 14 April?", the platform answers in seconds.
FIDO2 / WebAuthn
Sign in with YubiKey, Windows Hello, Touch ID. Phishing-resistant: a stolen email address gets attackers nowhere.
TOTP
Classic 2FA with Google Authenticator or similar.
NFC UID
Staff badge as physical 2FA. Lost a card? Instantly revocable.
Data export
Right of access (GDPR art. 15) one click away. Data exports as JSON or CSV.
Right to erasure
GDPR art. 17: we delete properly, including backups (with a clear window).
DPA template
Data processing agreement as a standard template. We sign it digitally.
EU hosting
Cloud runs in EU regions. No third-country transfer without your explicit consent.
Webhooks and external interfaces
External webhooks (Stripe, PayPal, SumUp, etc.) land on a dedicated hooks endpoint with HMAC and RSA signature verification. Translation: someone making up a Stripe webhookWebhookA webhook is an automatic message between two programs: when something happens, e.g. a payment, one system instantly notifies the other — with no one having to check manually. and firing it at your server doesn't get in.
Pen tests, security review
The platform is reviewed externally on a regular cycle. Pen test reports and security briefings are available on request, under NDA for SME and enterprise.
In the cloud, only you and your users. We only access with your explicit support-case approval, with an audit entry.
We can't recover it. You get a BIP39 recovery code when you set it up, so keep it safe. Lost = gone. That is the point of zero-knowledge.
Yes. Backups encrypted at rest, transfer encrypted, restore documented.
We are working on ISO 27001 and SOC 2. Current status on request.