Security at AYBN ERP
AYBN ERP uses access controls and security practices designed to protect business information and limit unauthorised access. This page explains what those controls are, and marks clearly what is still being confirmed.
In short
No software can promise to be completely secure, and we do not. What we can do is show you the actual controls in AYBN ERP, so you can judge them yourself and decide what your own team needs to do.
Everything you need to evaluate AYBN ERP
Each page answers one question a careful buyer asks before moving business data onto a new platform.
Access control & permissions
Who can open which screen, and who can create, edit or delete records.
Auditability
How documents stay linked from order to ledger, and what is recorded about who did what.
Backup & recovery
What is confirmed today, what is still being documented, and what you can export yourself.
GST & compliance approach
What the software does for GST, and what stays your responsibility.
Data privacy
What information is collected, why, who it is shared with and how you stay in control.
Privacy Policy & Terms
The legal documents, structured for review and marked where details are still being finalised.
Every change is checked on the server
The screens you see are only one layer. The checks that matter run on the server, for every request.
Permission check on every change
Each save, edit, cancel or delete re-checks your session and your role’s permission on the server before anything is written. Hiding a button is never the only protection.
Page access checked before a page opens
Every dashboard page checks that your role has view rights on that screen. Without it, you are sent to an “unauthorised” page instead.
Server-side validation
Form input is validated on the server before it is saved, not only in the browser.
Parameterised database queries
Database queries pass your input as parameters rather than building query text from it, which protects against SQL injection.
Restricted file uploads
Uploads such as logos and expense attachments accept only image and PDF files up to 10 MB, and are stored with generated file names in a dedicated folder.
All-or-nothing postings
Multi-step postings, such as an invoice with its stock and journal entries, are written in one database transaction. If one step fails, none of it is saved.
Sign-in that is hard to abuse
Verified email before first sign-in
New accounts must confirm their email address with a one-time code before they can sign in.
Sign-in attempt limits
Repeated failed sign-ins are temporarily blocked, both per account and per network address.
No account guessing
A sign-in for an email that does not exist takes the same time and returns the same message as a wrong password, so attackers cannot test which emails have accounts.
Deactivated users are locked out
A deactivated user cannot sign in, and any session they already had stops working.
- To be confirmed
Two-factor authentication
Sign-in uses email and password. A second sign-in factor is not available today.
Passwords are never stored in readable form
Hashed passwords
Passwords are stored only as salted one-way hashes (bcrypt). Nobody, including AYBN, can read your password back.
Short-lived one-time codes
Email verification and password reset codes are six digits, expire after 10 minutes, allow a limited number of guesses and are stored only as hashes.
Password reset by email code
A forgotten password is reset with a code sent to the account’s verified email address.
Password change signs out other sessions
When a password changes, sessions that were signed in with the old password stop working.
Session expiry
Sign-in sessions are kept in a signed cookie and expire after 30 days without use.
Each company’s data stays with that company
Company-separated records
Every read and write is scoped to the company you are working in. Users who belong to several companies switch between them explicitly, and can only switch into companies they are members of.
Encrypted provider credentials
Your GST provider (GSP) password and your mail server password are encrypted (AES-256) before they are stored, and are only decrypted on the server when AYBN uses them for you.
Your credentials only
e-Invoices and e-Way Bills are sent using your own company’s GSP credentials. AYBN never falls back to another company’s account or GSTIN.
- To be confirmed
Encryption of the whole database at rest
Whether the database storage itself is encrypted depends on the hosting set-up, which is being documented.
How data travels
Mail server security options
When you connect your own mail server, you can choose its TLS settings, and AYBN tests the connection before saving it.
- To be confirmed
HTTPS for the application
The certificate and HTTPS set-up of the hosted application are part of the infrastructure documentation that is being prepared.
Hosting, monitoring and maintenance
These details depend on how AYBN ERP is hosted and operated. They have not been confirmed for publication yet, so we do not describe them here.
Abuse protection on public forms
Sign-up, code requests and website enquiry forms are rate limited, and the website forms reject automated submissions.
- To be confirmed
Hosting provider and data location
Where AYBN ERP and its database are hosted, and in which country your data is stored.
- To be confirmed
Monitoring and incident response
How the service is monitored, and how incidents are handled and communicated.
- To be confirmed
Security updates
How often the application and its dependencies are updated. Product changes are listed on the product updates page.
Security features that are coming
These are on the product roadmap. They are not available yet.
- Upcoming
Audit trail
An append-only record of business changes will show who changed what, and when.
- Upcoming
Approval workflows for more documents
Approvals for more kinds of document will let you decide who must approve them before they take effect. Purchase orders and supplier payments already support maker-checker approval.
- Upcoming
Private document storage
Attachments on more kinds of document will be kept in private storage with downloads only for authorised users, as purchase invoice attachments are today.
What AYBN does, and what your team does
Security is shared. These are the controls each side is responsible for.
Checks permissions on the server, separates company data and protects sign-in.
Grants each role only the screens and actions that person needs.
Verifies email addresses, hashes passwords and locks out deactivated users.
Gives every person their own login, never shares passwords, and deactivates leavers promptly.
Encrypts GSP and mail server passwords and uses them only for your company.
Keeps the GSP and mail accounts themselves secure and updates passwords in AYBN when they change.
Writes postings as one transaction and protects e-invoiced and linked invoices from edits that would break them.
Enters accurate data, restricts delete rights, and reviews reports and GST data before filing.
Rate limits sign-in attempts and public forms.
Keeps the computers and phones used to sign in up to date and signs out of shared devices.
Related pages
Access control & permissions
How roles, screens and actions are controlled.
Administration features
Users, roles, companies and document settings.
Documentation: users & roles
Step-by-step set-up.
Report a security concern
If you believe you have found a security problem in AYBN ERP, e-mail acsaybn@gmail.com with the steps to reproduce it. Please do not access other people’s data while testing.
Have security questions before you decide?
Talk to our team about how AYBN ERP fits your controls, or read how it is set up.