Security & access
Security built into Fidar’s core, not bolted on
A company’s data — customers and contracts through to salaries and bank accounts — is its most sensitive asset. Fidar was designed on that assumption from day one: every request passes six permission layers, every change is recorded and no security decision is made only in the user interface.
Six-layer access
Every request passes six layers
Layers are checked in order and failing any one is enough to deny access. All of them are enforced on the server — in lists, search, reports, Excel exports and the API.
- “Why can they see this?”Admins see which role, scope and rule granted or denied access for any user and record.
- Delegation and temporary accessDeputies during leave with start and end dates; actions are logged with both names.
- 1SubscriptionIs this module active for the organisation?
- 2Role (RBAC)Does the user’s role allow this operation?
- 3Org scopeIn which company, branch, warehouse or department?
- 4Record ruleWhich records? For example “mine or my team’s”.
- 5Field securityWhich fields are hidden, read-only or editable?
- 6LimitsUp to what amount? Above the limit, approval.
Authentication
Secure sign-in for organisations of any size
Two-factor and passkeys
Authenticator-app codes, SMS or passkeys; mandatory for everyone or for sensitive roles.
Enterprise SSO
Sign in with your identity provider over SAML 2.0 or OIDC, plus LDAP sync on-premise.
Session management
Active devices, remote sign-out and IP or time-of-day restrictions per role.
Password policy and lock-out
Strong password hashing, configurable policy and lock-out after failed attempts.
Data protection
Your data: isolated, encrypted and traceable
Full tenant isolation
Tenant filtering in the application and in the database itself; no query runs without it.
Encryption of sensitive fields
Fields such as national IDs, bank accounts and tokens are encrypted at rest.
TLS 1.3 in transit
All connections encrypted; cookies are HttpOnly, Secure and SameSite.
Immutable audit log
Every change with before and after values, user, IP and time; entries are hash-chained so tampering is detectable.
Process
Security is a process, not just a feature
Fidar’s development baseline is OWASP ASVS level 2, and every capability is checked against it before delivery.
We don’t claim certifications we don’t have. Any security certification or audit Fidar receives will be published on this page with evidence.
In the development cycle
- Dependency scanning and static analysis on every change
- Automated secret scanning in the repository
- Server-side validation of all input and parameterised queries
- Error messages without internal details
- Automatic backups with periodic restore tests
- Independent penetration testing before general availability
ERP security FAQ
Is our data separated from other organisations?
Yes. Every request is filtered by tenant, both in the application and with row-level security rules in the database. If you need full physical separation, see the on-premise edition.
How are user access levels defined?
With roles and permissions for operations, then org scope, record rules, field security and amount limits. The basics are explained in what is RBAC.
Does Fidar support two-factor authentication?
Yes — with an authenticator app, SMS or passkeys. Admins can make it mandatory for everyone or for sensitive roles. More in what is MFA.
Who can see the audit log?
Organisation admins with audit-view permission, with search and filters. Nobody — not even an admin — can edit or delete audit entries.
Can Fidar support staff access our data?
Support impersonation is only possible with your consent, a permanent on-screen banner and full audit logging.
See Fidar’s security up close
In a demo we’ll show the access matrix, the “Why can they see this?” tool and the audit log on sample data.