Security and operations
How Erpper is secured and run.
Written for the person at your end who has to sign this off. It describes what the system does today, not what is planned.
One company's data cannot be read by another's.
Erpper holds more than one company in one database, which is the usual arrangement and the usual risk. The separation is enforced by the database itself: every table carrying company data has row-level security switched on and forced, so a query that forgets to filter returns nothing rather than returning somebody else's records. Getting it wrong fails closed.
Permissions, per company and per site.
Scoped to a legal entity
If you run several companies, a person is given access to the ones they work for. The rest are not merely hidden from the menu — the data is not returned.
Scoped to a warehouse
A supervisor at one site sees that site's work. Moving somebody between sites is a permission change, not a new login.
Checked on the server
Hiding a button is a convenience, not a control. Every action is authorised again on the server before it is allowed to happen.
Single sign-on
Staff sign in through your identity provider. Removing somebody there removes their access here, including sessions already open.
Every change keeps its evidence.
Who, when, and what it was before
Changes are recorded as evidence attached to the record, rather than as a log file that rotates away after a fortnight.
Approvals stay separate from the thing approved
A purchase order's approval and a supplier's promise are held apart from the order itself, so neither can be quietly rewritten by editing the other.
Overrides are recorded, not silent
Releasing an order past its credit limit is allowed, named and kept. Credit control can see who let it through.
Photographs as proof
Packing photographs stay attached to the order they belong to, which is what settles an "it arrived damaged" conversation.
Backups that are proved, not assumed.
Nightly and monthly
The database is backed up on a nightly and a monthly schedule, with point-in-time recovery between them.
Restores are actually performed
A restore runs automatically on a schedule and has to succeed. A backup nobody has ever restored is a hope, not a backup.
Traffic is encrypted
Everything is served over HTTPS. Plain HTTP is redirected before it reaches the application, including the sign-in pages.
Work that fails is retried, not lost
Background work — posting, printing, sending — is queued so that a failure is retried and visible rather than silently dropped.
Things we would rather say plainly.
Erpper holds no security certifications
We are not going to imply otherwise. What is described on this page is what is built. If your process requires a supplier with a formal accreditation, we are not one today.
Erpper is young
It is in use, not in wide use. If you need a supplier with a decade of references, we are not that yet — and you should ask us the question directly.
Ask for the detail
Hosting, where data is held, how long it is kept, who else touches it and what testing has been done are all fair questions. Ask, and we will answer them in writing.