Security
Built for Control.
Vitabu ERP holds your business's financial records, so security isn't a checklist item — it's the product. Here's what's actually implemented, in plain terms.
Tenant isolation
Every business on Vitabu ERP is a separate tenant. Application-level checks scope every query to your company — other tenants' data is never reachable from your account.
Password security
Passwords are hashed with bcrypt and never stored or logged in plain text. We can't see your password, and neither can anyone who gains access to the database.
Session handling
Sign-in uses a short-lived access token held only in memory in your browser, paired with an httpOnly, secure refresh cookie the browser's own JavaScript can never read — the standard defense against token theft via XSS.
Role-based access control
Every user is assigned a role built from granular permissions. What a user can see and do in your account is enforced on the server, not just hidden in the interface.
Two-factor authentication
Users can enable two-factor authentication (authenticator app, email or SMS code) for their own sign-in, and a company administrator can require it for all users.
Audit trail
Changes to financial records and security-relevant account events are recorded in an audit log, so you can see who did what and when.
Rate limiting & account lockout
Sign-in and password-recovery endpoints are rate-limited, and an account locks temporarily after repeated failed sign-in attempts.
Encrypted in transit
All traffic between your browser and Vitabu ERP is encrypted over HTTPS.
Reporting a security issue
If you believe you've found a security vulnerability in Vitabu ERP, please emailsupport@vitabuerp.comwith details. We'll respond and work with you to understand and address the issue.
See also our Privacy Policy for how we handle your data.
Ready to Bring Your Business Together?
Start with the capabilities you need today and expand the platform as your business grows.