In transit and at rest
Connections are encrypted with TLS and certificates are verified rather than merely accepted. Database connections use verified TLS. Passwords are stored as bcrypt hashes and are never recoverable in plain text.
Access control
Every page and every server action checks both the permission the role holds and the entitlement the organisation has. Scoping is applied in the data layer rather than by hiding menu items, so a record you may not see does not load.
Separation between customers
Each organisation is scoped by company, and records outside your scope return not-found rather than forbidden, so a probe cannot confirm that a record exists.
Audit
Sensitive actions are written to an audit log with the actor, the record and the time. Sessions can be revoked centrally.
Reporting a problem
If you believe you have found a vulnerability, write to info@elevateiqdigitals.com with the detail. We will acknowledge it and keep you updated. Please give us a reasonable window to fix it before publishing.