Your data stays yours, and travels with you
The most important thing a system can promise is that leaving it is possible.
Registered in Ghana and operating under the Data Protection Act 843. The two certifications we do not hold are named below rather than left out of the page.
Your people sign in the way they already do.
Google, Microsoft and Apple accounts, your own single sign-on, or a code to a phone. Each organisation picks which of these it offers its own staff, and the rest stay out of sight.
The account somebody already has, on the phone already in their hand. Nothing new to remember and nothing new to reset.
Bring the identity provider the rest of your organisation runs on. Staff arrive already signed in, and leavers lose access the moment you remove them there.
For the people a directory has never heard of -- a new intake, a field officer, a parent. One code, one number, and they are in.
An administrator ticks the ways in their own staff may use, puts them in the order they prefer, and writes the words beside the box in their own voice.
What protects your data today
Six things, each of which can be demonstrated on a screen rather than described in a sentence. Ask for any of them on the walkthrough.
Every page, every item, every invoice, in a format that is not ours. Not on request, not for a fee. A button.
Row-level separation tested by actually trying to read another organisation's data, not assumed from the design.
Daily, held thirty days, and restored on a schedule so we know it works before you need it.
A written statement of what we hold and why, deletion on request, and no selling of anything to anyone.
A storekeeper has no payroll rights, and editing and publishing are separate rights on purpose.
Who changed a permission, who exported what. Append-only, including for us.
What you would take with you, and in what form
This is the export, listed section by section. Nine files, CSV, generated on request from the screen you are already on — no ticket, no fee and no notice period. It is the same list whether you are evaluating us or leaving us.
| Section | What comes out | What opens it |
|---|---|---|
| Accounting | The ledger, the journals behind it, the tax lines and the period closings | Any spreadsheet, and any accounting package that reads a CSV import |
| Clients | Customers, their contacts, their addresses and the documents raised against them | Any spreadsheet, or a CRM's own import |
| Suppliers | Suppliers, purchase orders, receipts and what is owed to whom | Any spreadsheet |
| Services | The catalogue, what each thing is priced at and what it is made of | Any spreadsheet |
| Hire purchase | Agreements, schedules and what has been paid against each one | Any spreadsheet |
| Recruitment | Vacancies, applications and where each one got to | Any spreadsheet |
| Training | Programmes, admissions, registers, assessments and results | Any spreadsheet |
| Team | People, their roles and the rights attached to each role | Any spreadsheet |
| Oversight | The audit log — who changed what, and when | Any spreadsheet |
What we do, and when you hear about it
Every supplier has a bad day eventually. What separates them is whether you find out from the supplier or from somebody else, and how long that takes. This is the sequence, written down before it is needed rather than drafted during it.
- Contain it
Close the route in, revoke whatever was reachable through it, and preserve the log before anything is cleaned up. The audit log is append-only, including for us, which is what makes the next three steps possible at all.
- Tell the organisations affected
Within one working day of knowing, by name, to the administrator on the account — what we know, what we do not yet know, and what we are asking you to do. An organisation whose data was untouched is told that too, because silence reads as the other thing.
- Tell the regulator where the Act requires it
Act 843 decides that, not us, and the determination is made with the facts written down rather than from memory. Where it applies we will tell you we are making the report and what it says.
- Publish what happened
A written account afterwards: what the route in was, what it reached, how long it was open and what has changed so that it closes. Sent to every affected organisation whether or not they asked.
Timings are from the moment we know, and the first message goes out before we have the full picture rather than after. A complete account that arrives a week late is worth less to you than a partial one that arrives the same day.
What we are certifying next
Two certifications we do not hold, named here rather than in a footnote, because the page would otherwise read as though we held them.
None has been carried out. We will publish the date when one has. Saying nothing would be easier and would not be true.
We hold neither. The controls above are real and are tested; the audit that would let us print a logo has not been bought.
Five things that stay yours to do
Most of what goes wrong in a business this size goes wrong through a person rather than through software. These five are inside the product and switched on by an administrator, and they are the ones worth doing in the first week.
- Turn on a second factor for the people who approve things
Anybody who can approve a payment, change a bank detail or edit a permission. A password is one thing somebody can be talked out of over the phone; a second factor is a second conversation they are much less likely to have.
- Give people the rights for the job they do
Rights are per section and editing is separate from publishing, so a storekeeper with no payroll rights is a setting rather than a promise. The default for a new person should be the narrow one, widened when somebody asks.
- Take rights away the day somebody leaves
The commonest real breach in a firm of this size is an account that was left open. Removing it is one screen, and the audit log keeps everything that person did, so there is nothing lost by doing it the same afternoon.
- Read the audit log once a month
Ten minutes. Who changed a permission, who exported what, who edited a bank detail. The log being append-only matters only if somebody occasionally looks at it.
- Decide who may approve a change of bank details
A supplier's account number changing is the single most profitable thing for somebody to forge, and the approval for it is a setting you control. Set it to two people before you need it to be.
Six questions, answered before they are put to us
These come back on nearly every security questionnaire we are sent. Answering them on the page saves a fortnight of email, and where the answer is an absence it is written as one.
Can another organisation on this platform see our data?
No, and the separation is enforced in the database rather than in the application: a policy on every relation restricts a query to the organisation the signed-in person belongs to, and it is a restrictive policy, which means it is an AND rather than an alternative. It is tested by actually attempting the read as another organisation rather than inferred from the design.
Do your staff read our data?
Only with an account inside your organisation, which you create and you remove. Support work is done against what you can see on your own screen or against information you send us. Anything we do leaves a row in your audit log, which you can read and we cannot edit.
Has anybody independent tested this?
No. No external penetration test has been carried out. It is the one item in the procurement pack that is not ready and it has no date yet, and both of those facts are on the page rather than in a conversation. When it is done we will publish the date and the summary.
Do you hold SOC 2 or ISO 27001?
Neither. The controls listed above are real and are tested; the audit that would let us print a logo beside them has not been bought. A supplier our size that claims both is worth asking to show you the report.
What happens to our data if we leave?
You export all nine sections, the account is closed on the date you give, and what we hold is deleted on request under Act 843. The export is the same button you can press during the evaluation, which is the point of it being a button.
How often are backups restored rather than just taken?
Daily backups, held thirty days, and restored on a schedule rather than when something has already gone wrong. A backup that has never been restored is a file, not a backup.
Ask for the security questionnaire
Answered in writing, before you have to put it to your own IT people.