Security & Administration

1. Infrastructure

VIA ERP runs on DigitalOcean servers in Frankfurt, Germany. Your data stays in the European Union. Company headquarters: Tunis, Tunisia.

2. Encryption

All communications go over SSL/TLS (HTTPS). Passwords are hashed with bcrypt and are never stored in plain text. Stored credentials, your mailbox connection tokens and the bank statements you import are encrypted at rest with AES-256-GCM.

3. Authentication

Any user can turn on two-factor authentication: a one-time code is then emailed at each sign-in. Sessions expire automatically — after one day by default, or thirty days if you choose to stay signed in. Roles and permissions are set user by user.

4. Backups

The database and your files are backed up every day. A restore can be requested from support.

5. Audit trail

Changes to contacts, leads, opportunities, journal entries, stock movements and campaigns are recorded with the user, the date and the values that changed. The history is available from the record itself.

6. Compliance

• Hosting in the European Union for personal data protection (GDPR)
• Tunisian tax compliance (19% VAT, fiscal stamp)
• Transparent data retention policy

7. Security testing

Code is reviewed for security, and dependencies and container images are scanned for known vulnerabilities on every proposed change.

8. Users and roles

An administrator invites users by email from Administration > Users, and gives each of them one or more roles. The roles follow the functional families — sales, purchase, inventory, finance, projects, marketing, support — each in a manager and a user form, alongside the administrator role and a read-only viewer role. The role a user carries decides the navigation they see: they get the modules of their own area, not the whole menu.

A read-only role cannot change or delete anything. That rule is applied globally, on every route of the application, rather than screen by screen.

9. Separation by company Business+

Several companies can live in one account. Each carries its own documents and its own general settings, document numbering included, and a user works in one company at a time: the other companies’ data stays out of their lists.

10. Document approvals Professional+

The approval requirement is turned on per document type. A document that needs one then waits for a decision — approved or rejected, with a history that keeps the person and the date. An approver who is away can delegate their approvals to a colleague for a set period.

11. Accounting period locking Business+

A closed accounting period takes no further entry: no creation, no edit, no reversal, no deletion. The check sits in one place, which manual entries and the entries other modules post automatically both go through.

12. Vulnerability reporting

If you discover a vulnerability, please report it responsibly to info@innoway-solutions.com.