Controls you can verify, not badges you have to trust.
Tenant isolation
Every business runs in its own tenant. Settings, users, roles, branches, documents, orders and reports are scoped to that tenant at the data-access layer, not by convention in the UI.
Role-based access and branch scoping
Permissions are granted per role and per branch. A cashier can sell without refunding; a branch manager sees only their branch; an accountant posts without changing prices. Users can be limited to all, selected, or no branches.
Audit history
Create, update, approve and delete actions on business records are written to an audit trail with who, when and what changed, so a dispute or a reconciliation has evidence, not memory.
Authentication
Email-verified accounts, password policy, optional two-factor authentication by one-time code, session management, and rate limiting on login, OTP and public endpoints.
Encryption and transport
All traffic is served over HTTPS with HSTS. Uploaded documents are validated by type and size before storage. Public forms are protected by server-issued single-use challenges.
Backups and continuity
Tenant data is backed up on a schedule with retention, and restore procedures are tested as part of release readiness. Data-processing terms describe retention and deletion on request.
KYC and business verification
Tenant onboarding includes business-verification steps so platform operators know who is running each workspace before commercial features are enabled.
Data residency and sub-processors
Hosting region and the list of sub-processors are documented in the data-processing policy. Cross-border transfer terms are stated there rather than implied.
Where these controls live in the product
- Tenant Management
- Branch Management
- User Management
- Roles & Permissions
- Tenant Settings
- KYC / Business Verification
- Audit Trail
- Notifications
- Number Sequences
- File/Documents Management
Report a vulnerability: see security.txt.
Security questions buyers ask
Is Farexa a single shared database for all customers?
Farexa is multi-tenant: customers share the platform but every record carries tenant scope enforced at the data-access layer, and users can never query across tenants. Branch scoping adds a second boundary inside each tenant.
Can I restrict a user to one branch?
Yes. Each user has branch access set to all branches, selected branches, or none. List views, reports and summaries are filtered by that access automatically.
Do you have ISO 27001 or SOC 2?
Not yet. We publish the controls we actually run on this page and in the data-processing policy, and we will list certifications here only when they are issued.
Who can see the audit trail?
Tenant administrators and roles you grant the audit permission to. Audit entries are read-only and cannot be edited from the application.
Where is my data hosted?
The hosting region and sub-processors are listed in the data-processing policy, which is kept current with each infrastructure change.
Need a security review before you buy?
Send your questionnaire and we will answer it control by control.