Security, RBAC & Compliance — ERP security and access control
Security is architecture here, not a checkbox: every tenant lives in its own database, every action checks a fine-grained permission, and two independent audit systems record who did what and what the data was before and after.
Book a live demoWhat you get
- A separate database per tenant — isolation by construction
- Fine-grained permissions (module : resource : action), role templates per tenant
- TOTP MFA, WebAuthn passkeys, OIDC and SAML SSO
- Hash-chained audit log (tamper-evident) + field-level before/after history
- Tenant URL isolation — credentials cannot cross subdomains
- IP allow/deny controls and security signal feeds
What each role gets
- Tenant admin — Owns the front door to the tenant: sets the password policy and session length, and requires MFA or passkeys for whichever roles need it, with a grace period before enforcement kicks in. Configures OIDC or SAML single sign-on against any major identity provider — every callback's signature is verified, with no insecure fallback — and revokes any user's active sessions on demand. Manages the full role and permission catalogue for the tenant, switches on a tamper-evident hash-chained audit log with configurable retention, and reads that trail filtered by user, action or module whenever something needs investigating.
- Every user — Every account gets self-service security: two-factor authentication by scanning a QR code and saving one-time backup codes, or phishing-resistant passkeys — Touch ID, Windows Hello, or a hardware key — set up right from the user's own profile. Shows every device and browser currently signed in, each with its location and last-active time, and signs any of them out in one click — the fastest way to react to a lost device or a login that looks unfamiliar.
Frequently asked questions
How is tenant data isolated?
Physically: each tenant has its own database. There is no shared-table multi-tenancy, so cross-tenant leakage classes that plague shared-schema ERPs cannot occur by construction.
Is there a real audit trail?
Two: a legally-oriented hash-chained audit log for personal-data actions, and a field-level change history recording every value before and after — both queryable.
Part of one platform
Security, RBAC & Compliance is one of 30+ modules sharing the same login, the same people, the same customers and the same AI copilot — see all modules or how Tarleaks ERP compares to Odoo, ERPNext and Zoho.