Security in Validure ERP
Validure ERP is specified to keep each company's data separate, give every user only the access their role needs, and record every change to your books in an append-only audit trail. This page describes what the product is designed to do: Validure ERP is pre-launch, so nothing here is a measured or certified result.
Is my company's data kept apart from other businesses?
Yes. Validure ERP is specified so that every database query is limited to your company, and the application adds that limit to each query automatically, so one company cannot read another company's records.
Who can see and change what?
Validure ERP has 5 roles for your company, and each role opens only its own part of the app.
| Role | What it can do |
|---|---|
| Company Owner | Everything in the company, including users, settings and the plan |
| Accountant | Purchases, expenses, treasury, books, GST and reports; views sales documents |
| Sales executive | Quotations, invoices, Daily Bulk Billing and customer receipts; cannot edit historical journals or company settings |
| Field sales agent | Only their assigned leads in the field CRM; no accounting or GST access |
| Auditor (CA) | Read-only: ledgers, statements, GST summaries and the audit trail |
How are passwords and sign-ins protected?
Validure ERP is specified to store passwords only as bcrypt (work factor 12 or more) or Argon2id hashes, and never to log or store them in plain text. Passwords need at least 8 characters, sign-in tokens are signed and last 24 hours at most, and an expired sign-in returns you to the sign-in page.
Is my data encrypted in transit?
Yes. Validure ERP is specified to serve every connection over HTTPS with TLS 1.3 and to reject or redirect plain HTTP. Encryption at rest and the hosting region are Configured at go-live.
How is Validure ERP protected against injection attacks?
Validure ERP is specified to run every database query as a parameterised statement and to sanitise text input against cross-site scripting (XSS).
What does the audit trail record?
Validure ERP records every create, update, delete and status change on invoices, vouchers, journals, masters, settings and user permissions, and every sign-in. Each entry keeps the user, the time to the millisecond, the IP address, the browser, and the values before and after the change.
- Entries are append-only: nobody, including the Company Owner, can edit or delete them.
- Invoices, receipts and vouchers are cancelled, not deleted; only drafts can be deleted.
- Deactivating a user stops their sign-in but keeps every record they made.
Example (demo data): audit entry aud-00377 records that Ritabrata Ghosal, the Company Owner, reduced the credit limit of New Market Provision Stores from ₹1,50,000.00 to ₹1,00,000.00 on 2 Jul 2026 at 10:20:34.117 IST, and it keeps the IP address and the browser as well.
What happened
Customer · New Market Provision Stores
Ritabrata Ghosal reduced the credit limit of New Market Provision Stores from ₹1,50,000.00 to ₹1,00,000.00.
Note: “Limit reduced after repeated late payments.”
| Field | Before | After |
|---|---|---|
| Credit limit | ₹1,50,000.00 | ₹1,00,000.00 |
Append-only: this entry cannot be edited or deleted.
How to review the audit trailOpen audit entry aud-00377 in the demo
How is the field CRM on a phone protected?
The Validure ERP field CRM locks with a 4-digit PIN, so customer contacts stay closed if a phone is left unattended. Field sales agents see only their assigned leads and have no access to accounts or GST.
Is my data backed up?
The Validure ERP service is specified, as a design target rather than a measured result, to take automatic full daily backups with point-in-time recovery and a recovery point objective of 1 hour or less.
What can Validure Solutions' administrators do?
Validure Solutions runs a Head Admin console for the platform. Its administrators can see each company's owner, contact details, GSTIN, plan and status; activate, suspend or extend a company's plan; reset a company admin's password; and read the platform audit trail.
Is Validure ERP certified?
No. Validure ERP is pre-launch and holds no security certification or audit report, such as ISO/IEC 27001 or SOC 2. The hosting region, uptime commitments and security contact are Configured at go-live.