> ## Documentation Index > Fetch the complete documentation index at: https://docs.erp.arukz.com/llms.txt > Use this file to discover all available pages before exploring further. # Security and your data in ARUKZ ERP > How ARUKZ ERP keeps each company's records apart, who can see what, how sign-in and API tokens are protected, and how backups work today. Every record in ARUKZ ERP belongs to one company, and the application only ever returns records of the company you are signed in to; automated tests that check one workspace cannot read another's data run on every release. Inside your company, roles decide which screens each person can use and record visibility decides whose records they see. Pages are served only over HTTPS, passwords are stored hashed, and the database is backed up every night. ## One company cannot see another * **Every business record carries its company.** Orders, invoices, lots, employees, roles and attachments are filtered by company on every request, including through the API, search and exports. * **A company admin manages only their own company.** They cannot see other companies' users, give anyone the ARUKZ platform role, change the shared roles, install plugins or add database fields. * **Your own address.** Your team signs in at `erp.arukz.com//admin`; a person who is not a member of that company is refused, and an unknown address returns "not found". See [Company address](https://docs.erp.arukz.com/admin/company-address.md). * **ARUKZ staff** can reach every workspace to run the platform. At most two staff sign-ins can be open at a time, and their actions on a workspace (activations, suspensions, plan changes, payments) go to an append-only log. ## Sign-in and access | Protection | What it does | | - | - | | HTTPS and HSTS | Every page is encrypted in transit, and browsers are told never to fall back to plain HTTP | | Hashed passwords | Passwords are never stored in readable form | | Two-factor sign-in | Each person can add an authenticator app, with recovery codes, from their profile | | Roles and record visibility | See [Users and roles](https://docs.erp.arukz.com/admin/users-and-roles.md) | | Deactivation | An inactive user cannot sign in, and all their API tokens stop working | | API tokens | Five login tries a minute, refused for two-factor accounts, read-only tokens available, 30-day expiry, revoked on a password change. See [Authentication](https://docs.erp.arukz.com/api-reference/authentication.md) | | Lapsed workspaces | API tokens of a read-only workspace can only read; those of a suspended one are refused | | Downloads | Invoice, order and quotation files are stored under random 40-character folder names, not guessable addresses | ## Your books * **Edit log.** Changes to the books are logged by the database with who, when, before and after, sealed into a daily hash chain, and cannot be switched off. See [Audit trail](https://docs.erp.arukz.com/admin/audit-and-edit-log.md). * **Export at any time.** An admin can download every business table as CSV, also while the workspace is read-only. See [Export all data](https://docs.erp.arukz.com/admin/export-data.md). * **Nothing is deleted when you stop paying.** A lapsed workspace turns read-only, and a cancelled one stays readable for 90 days. See [Read-only mode](https://docs.erp.arukz.com/admin/read-only-mode.md). ## Backups The database is backed up every night, each backup is checked after it is written, and the last fourteen copies are kept. > [!WARNING] > > Today these backups are kept on the same server as the application. Encrypted copies on a separate server, and a backup location in India, are planned but not live. If your company must keep a daily backup of its books on servers in India under the Companies (Accounts) Rules, take your own regular exports in the meantime. ## AI and your data AI is off until the AI module is switched on for your company **and** a company admin switches it on in **AI settings**, which records who agreed and when. After that, questions, the figures needed to answer them and bills you upload are sent to the AI provider. An AI app you connect over [MCP](https://docs.erp.arukz.com/ai/mcp.md) is different: it reads with a person's own API token, so what it reads goes to that app's provider under the terms of whoever set it up. The assistant and the MCP server only read; they cannot post, pay or change anything. See [Ask AI](https://docs.erp.arukz.com/ai/ask-ai.md). ## What is not in place yet * Encrypted backups on a separate server, and a restore drill (planned). * A Content-Security-Policy header. * Published privacy, terms and refund policies. Ask ARUKZ if you need them for a vendor review. > [card] [Known limits](https://docs.erp.arukz.com/resources/known-limits.md) > > Everything ARUKZ ERP does not do yet, in one list. > [card] [Users and roles](https://docs.erp.arukz.com/admin/users-and-roles.md) > > Decide who sees what. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.