Security built into your data, not bolted on after the fact.
MetalogixERP enforces strict per-tenant isolation on every record, deep in your data — not in app code that can slip. Sign-in rotates session tokens with reuse detection and locks accounts after five failed attempts. We publish what we do and we mean it.
Four guarantees we hold ourselves to.
Tenant isolation, auth hygiene, audit trail, and edge hardening — defined, implemented, and documented. Not marketing claims.
Strict isolation at the data layer
Every business record is walled off by tenant, enforced deep in your data rather than in app code that can slip. Isolation also runs by company, so a multi-entity business keeps each legal entity separated too. A bug in application logic simply cannot leak one customer’s data to another.
- Per-tenant isolation on every record
- Per-company isolation within a tenant
- Enforced at the data layer, not app code
- Elevated access reserved for system tasks only
Auth that respects modern threats
Signed sessions with strict, fully-validated tokens. Session rotation with reuse detection — a replayed token kills the entire session family instantly. Accounts lock after 5 failed attempts. Password-reset links are single-use, expire in an hour, and can’t be replayed.
- Strictly validated signed sessions
- Session rotation with reuse detection
- Account lockout after 5 attempts
- Single-use, expiring password resets
Audit trail on every record
Every record carries its full history — who created it, who last touched it, and when. Nothing is ever truly deleted; records are retired, not erased. The audit log captures every change with the actor, a before/after diff, and a request trace, all searchable in the audit module.
- Non-guessable record IDs
- Retire-don’t-erase — no hard deletes
- Audit log with actor, diff, and request trace
- Fast time-range search across history
Edge + transport
A hardened edge with the full set of modern browser-security headers, encrypted transport everywhere, and locked-down session cookies that script can’t read or steal. Sign-in and password-reset endpoints are rate-limited, and every tenant gets fair-use API caps by plan.
- Full set of browser-security headers
- Locked-down, script-proof session cookies
- Rate-limited sign-in and reset endpoints
- Per-tenant fair-use API caps by plan
Honest about where we are.
We are a young company, so we tell you plainly which frameworks we support today and which are still on the roadmap. No badges we haven't earned.
GDPR & CCPA
Supported by designAccess, export, and erasure are built into the platform — the audit module records every subject request. A data processing addendum is available on request.
PCI DSS
Out of scopeCard payments are tokenized through Stripe — MetalogixERP never stores card numbers, so cardholder data stays out of our environment.
SOC 2
RoadmapThe technical controls a SOC 2 audit looks for — access control, audit logging, encryption — are already in place. Formal attestation is on the roadmap; we are not yet certified.
ISO 27001
RoadmapOur information-security practices are modelled on the ISO 27001 control set. Formal certification is planned, not yet held.
How a single API request is secured, end to end.
Five enforcement points between client and row. Each one is independent — defense in depth means a slip at one layer is caught by the next.
- ClientBrowser or mobile · session held in a script-proof cookie
- Secure edgeEncrypted transport · security headers · rate-limit
- ApplicationValidate the signed session · validate every input
- Isolation contextTenant and company stamped onto the request
- Your dataEvery query filtered to your tenant and company
The edge is the first filter. It encrypts transport, applies the full set of browser-security headers, and rate-limits unauthenticated traffic. A flood on the sign-in endpoint never reaches the application.
The application enforces shape. The signed session is fully validated before anything runs, and every request body and parameter is checked against a strict schema. Reject early, reject loud.
Your data enforces ownership. Before any query runs, the request's tenant and company are stamped onto the session. Every read, update, and delete is then filtered to exactly what you own. A bug in application logic cannot return a record from another customer — the record simply never comes back.
Built to survive bad days, too.
Encryption in transit and at rest, automated backups with point-in-time recovery, no standing super-user, and AI that inherits your access rather than bypassing it. The operational floor you need before you trust a system with the whole business.
Encryption
Encrypted in transit everywhere — the site, the app, and the API only speak over TLS. Data is encrypted at rest on the underlying storage, and session cookies are locked down so scripts can neither read nor steal them.
Backups & recovery
Automated backups with point-in-time recovery, so a bad import or an accidental change can be rolled back. Nothing is ever hard-deleted — records are retired, not erased — which means most "gone" data is recoverable from history alone.
No standing super-user
The application connects with a role that cannot bypass tenant isolation. Elevated database access exists only for controlled system tasks — migrations, backups, background jobs — never for handling your day-to-day requests.
Hosting
Hosted in a single region behind a hardened edge. Your data stays within that deployment and is never sold, shared, or handed to a third party for their own use. Multi-region residency options are on the roadmap.
AI & MCP access
The copilot and the MCP server act as the signed-in user — the session is forwarded, so every AI read and write passes the same isolation rules. An agent never sees a record the user could not. Bring your own model provider; there is no standing super-user behind the AI.
Found something? Tell us. We'll respond.
Report a vulnerability and a real person reads it. We triage promptly, keep you posted while we fix, and credit researchers who want the acknowledgement.
Email peter@metalogix.solutions. Please give us reasonable time to remediate before public disclosure. We do not pursue legal action against good-faith research.
- A person triages every report — no auto-responder black hole
- Public credit for researchers who ask for it
- Safe harbor for good-faith research
peter@metalogix.solutions
One human reads every inbound. Encrypted reports welcome — GPG key available on request, replied with the fingerprint inline.
Want a security review walkthrough?
Our CTO will walk your team through how we isolate your data, secure sign-in, and audit every change. 45 minutes, live.