Security Overview

Data Security

All data is protected using industry-standard encryption both at rest and in transit.

EU Primary Region

All customer data is stored and processed within the European Union, ensuring compliance with data residency requirements.

Access Controls

Fine-grained access controls ensure that users only see and modify what they are authorized to.

• Role-Based Access Control (RBAC)

  Predefined roles (Admin, Sales, Distribution, Customer) with configurable module-level permissions

• Multi-Factor Authentication (MFA)

  Firebase Authentication with support for email/password, phone, and third-party identity providers

• Session Management

  Automatic session expiry, rate limiting per user (30 req/min), and Firebase App Check attestation

Audit Logging

Every data-modifying action is recorded in an append-only audit trail, designed for GoBD compliance and full traceability.

• Append-Only Audit Trail

  Immutable log of all create, update, delete, and status change operations

• GoBD-Ready

  Compliant with German GoBD requirements for digital record-keeping in commercial operations

• Field-Level Diffs

  Each audit event captures exactly which fields changed, by whom, and when

Data Retention

Configurable data retention policies that comply with legal requirements while respecting your data minimization preferences.

Incident Response

We maintain a comprehensive incident response plan to detect, contain, and recover from security incidents with minimal impact.

Compliance Roadmap

Our ongoing commitment to achieving and maintaining recognized security certifications.