Data Security and Compliance

  <p class="compact-content-paragraph">Data security, confidentiality, and compliance are critical for every ERPNext implementation. Businesses trust us with <span class="handbook-highlight-blue">sensitive operational, financial, employee, and customer information</span>, and we take that responsibility seriously. Our practices are designed to protect client information, reduce security risks, maintain system reliability, and support <span class="handbook-highlight-pink">long-term business continuity</span>.</p>
  <div class="handbook-onboarding-metric-cards handbook-support-metrics handbook-security-metrics">
    <div class="handbook-metric-card"><strong>Multi-layer</strong><span>Data protection approach</span></div>
    <div class="handbook-metric-card"><strong>Least-privilege</strong><span>Access control</span></div>
    <div class="handbook-metric-card"><strong>Daily</strong><span>Backups + hourly increments</span></div>
    <div class="handbook-metric-card"><strong>ISO · GDPR · SOC 2</strong><span>Aligned practices</span></div>
  </div>

  <h2 class="compact-content-heading">Client Data Protection</h2>
  <p class="compact-content-paragraph">We follow a <span class="handbook-highlight-blue">multi-layered data protection approach</span> to keep client information secure during implementation, support, and maintenance. Sensitive data is protected using secure encryption during both storage and transmission, and access is restricted by user roles and responsibilities so only authorized individuals can reach production data.</p>
  <img class="handbook-wide-image" src="/files/client-data-protection%20.png" width="1025" height="652" alt="ERPNext client data protection with encryption and role-based access" />
  <p class="compact-content-paragraph">Where required, test or development data may be anonymized to protect sensitive business information during customization and testing. Customers always retain ownership of their ERPNext data, including the ability to request <span class="handbook-highlight-pink">exports, backups, or deletion</span> based on project agreements.</p>
  <div class="handbook-onboarding-kickoff-summary">
    <div class="handbook-onboarding-kickoff-summary-card">
      <span><span class="handbook-scope-icon handbook-scope-icon-green" aria-hidden="true"></span> Outcome</span>
      <strong>Confidentiality and compliance readiness</strong>
      <p>This secure data-handling process helps businesses maintain confidentiality, operational security, and compliance readiness.</p>
    </div>
  </div>

  <h2 class="compact-content-heading">Production System Access Control</h2>
  <p class="compact-content-paragraph">Access to the live production system is <span class="handbook-highlight-black">strictly controlled</span> and provided only to authorized personnel.</p>
  <p class="compact-content-paragraph"><span class="handbook-highlight-black">Depending on project scope, production access may be granted to:</span></p>
  <div class="handbook-onboarding-metric-cards">
    <div class="handbook-metric-card"><strong>01</strong><span>Approved client administrators</span></div>
    <div class="handbook-metric-card"><strong>02</strong><span>Assigned project managers</span></div>
    <div class="handbook-metric-card"><strong>03</strong><span>ERPNext support engineers</span></div>
    <div class="handbook-metric-card"><strong>04</strong><span>Technical team members for deployment or troubleshooting</span></div>
  </div>
  <p class="compact-content-paragraph">We follow the principle of <span class="handbook-highlight-blue">least-privilege access</span> &mdash; users receive only the minimum access required for their role. All production access is monitored and logged for transparency and accountability.</p>
  <img class="handbook-wide-image" src="/files/production-system.png" width="1025" height="652" alt="ERPNext production system access control and least-privilege monitoring" />
  <div class="handbook-agile-feedback">
    <p><span aria-hidden="true">ℹ️</span> <strong>Why it matters:</strong> Temporary access for troubleshooting or deployments is provided only when required and revoked once the activity is complete &mdash; reducing security risks and better protecting critical business data.</p>
  </div>

  <h2 class="compact-content-heading">Backup &amp; Disaster Recovery</h2>
  <div class="handbook-security-banner">
    <span class="handbook-security-banner-icon" aria-hidden="true"><svg viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><ellipse cx="12" cy="5" rx="7" ry="2.6" stroke="currentColor" stroke-width="1.6"/><path d="M5 5v6c0 1.44 3.13 2.6 7 2.6 1.05 0 2.05-.09 2.95-.24" stroke="currentColor" stroke-width="1.6" stroke-linecap="round"/><path d="M5 11v6c0 1.44 3.13 2.6 7 2.6.62 0 1.22-.03 1.8-.09" stroke="currentColor" stroke-width="1.6" stroke-linecap="round"/><path d="M20 16a3.6 3.6 0 0 1-6.1 2.2m-.4-2.9a3.6 3.6 0 0 1 6.1-2.2" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"/><path d="M19.6 11.4v1.9h-1.9M14 19.5v-1.9h1.9" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"/></svg></span>
    <p><strong>Your data, always recoverable.</strong> Daily full backups and hourly increments for critical systems, encrypted and stored in geographically separate environments &mdash; then verified by restore testing so recovery actually works when it matters.</p>
  </div>
  <p class="compact-content-paragraph">Regular backups are essential for protecting business continuity and preventing data loss. <span class="handbook-highlight-black">We follow a structured backup and disaster recovery process:</span></p>
  <div class="handbook-issue-detail-list">
    <div class="handbook-issue-detail-card"><strong>Daily full backups</strong><span>Complete system snapshot every day</span></div>
    <div class="handbook-issue-detail-card"><strong>Hourly incremental backups</strong><span>For critical systems</span></div>
    <div class="handbook-issue-detail-card"><strong>Secure backup storage</strong><span>Protected storage environment</span></div>
    <div class="handbook-issue-detail-card"><strong>Encrypted backup retention</strong><span>Backups kept encrypted</span></div>
    <div class="handbook-issue-detail-card"><strong>Periodic verification &amp; restore testing</strong><span>Backups are tested by restoring them</span></div>
  </div>
  <p class="compact-content-paragraph">Backups are stored in <span class="handbook-highlight-blue">secure, geographically separate environments</span> to improve recovery reliability in case of unexpected failures or disasters.</p>
  <div class="handbook-onboarding-kickoff-summary">
    <div class="handbook-onboarding-kickoff-summary-card">
      <span><span class="handbook-scope-icon handbook-scope-icon-green" aria-hidden="true"></span> Outcome</span>
      <strong>Recovery and long-term data protection</strong>
      <p>Our retention policy is designed to support operational recovery, compliance requirements, and long-term business data protection.</p>
    </div>
  </div>

  <h2 class="compact-content-heading">NDA &amp; Confidentiality Commitment</h2>
  <p class="compact-content-paragraph">Confidentiality is a core part of every engagement. We sign <span class="handbook-highlight-blue">Non-Disclosure Agreements (NDAs)</span> and confidentiality agreements with customers to protect the following</p>
  <ul class="handbook-onboarding-check-list">
    <li>Business information</li>
    <li>ERPNext customizations</li>
    <li>Financial and operational data</li>
    <li>Process documentation</li>
    <li>Technical architecture and workflows</li>
  </ul>
  <p class="compact-content-paragraph">Internal employees, consultants, and external vendors working on projects are also bound by confidentiality obligations and security policies. Where required, we can customize NDA and confidentiality agreements based on industry regulations, regional compliance requirements, or client-specific legal policies.</p>
  <div class="handbook-agile-feedback">
    <p><span aria-hidden="true">ℹ️</span> <strong>Why it matters:</strong> This confidentiality and secure project-engagement process helps build trust and ensures sensitive business information remains protected.</p>
  </div>

  <h2 class="compact-content-heading">Security Standards &amp; Compliance</h2>
  <p class="compact-content-paragraph"><span class="handbook-highlight-black">Aligned with the standards your auditors expect.</span> Our practices may align with ISO 27001, GDPR, SOC 2, secure software development, and audit-logging standards &mdash; with extra support for regulated industries like healthcare, finance, and payment processing.

We follow industry-standard security and compliance best practices.

Depending on project requirements, compliance practices may align with:

For industries with additional compliance requirements such as healthcare, finance, or payment processing, we can also support compliance-focused implementation practices wherever applicable.

  <h2 class="compact-content-heading">Our Commitment to Security &amp; Trust</h2>
  <p class="compact-content-paragraph">Data security is not a one-time activity; it is an <span class="handbook-highlight-blue">ongoing process</span> integrated into our implementation, support, maintenance, and infrastructure practices. By following secure implementation methodologies, structured access controls, backup policies, and confidentiality practices, we aim to provide customers with a secure, transparent, and dependable ERPNext experience.</p>

  <h2 class="compact-content-heading">Frequently Asked Questions</h2>
  <div class="handbook-faq-list">
    <div class="handbook-faq-item"><button class="handbook-faq-question" type="button" aria-expanded="false"><span>Who owns our data?</span><span class="handbook-faq-chevron" aria-hidden="true"></span></button><div class="handbook-faq-answer"><p>You do. Customers always retain ownership of their ERPNext data, including the ability to request exports, backups, or deletion based on project agreements.</p></div></div>
    <div class="handbook-faq-item"><button class="handbook-faq-question" type="button" aria-expanded="false"><span>How is our data protected?</span><span class="handbook-faq-chevron" aria-hidden="true"></span></button><div class="handbook-faq-answer"><p>Through a multi-layered approach: secure hosting, role-based access, multi-factor authentication, activity monitoring and audit logs, secure file-sharing, and controlled environment access &mdash; with encryption applied to data both at rest and in transit.</p></div></div>
    <div class="handbook-faq-item"><button class="handbook-faq-question" type="button" aria-expanded="false"><span>Who can access our live system?</span><span class="handbook-faq-chevron" aria-hidden="true"></span></button><div class="handbook-faq-answer"><p>Only authorised personnel: approved client administrators, assigned project managers, ERPNext support engineers, and technical team members for deployment or troubleshooting. We apply least-privilege access, and temporary access is logged and revoked once the task is done.</p></div></div>
    <div class="handbook-faq-item"><button class="handbook-faq-question" type="button" aria-expanded="false"><span>What's your backup and recovery setup?</span><span class="handbook-faq-chevron" aria-hidden="true"></span></button><div class="handbook-faq-answer"><p>Daily full backups, hourly incremental backups for critical systems, secure storage, encrypted retention, and periodic verification with restore testing. Backups are kept in secure, geographically separate environments for recovery reliability.</p></div></div>
    <div class="handbook-faq-item"><button class="handbook-faq-question" type="button" aria-expanded="false"><span>Do you sign NDAs and meet compliance standards?</span><span class="handbook-faq-chevron" aria-hidden="true"></span></button><div class="handbook-faq-answer"><p>Yes. We sign NDAs and confidentiality agreements covering business information, customizations, financial/operational data, process docs, and technical architecture. Practices may align with ISO 27001, GDPR, SOC 2, secure development, and audit logging, and can be tailored for healthcare, finance, or payment-processing requirements.</p></div></div>
  </div>