Tenant isolation
Every product scopes data access to the organisation that made the request. In ERP the scope is part of every storage key; HRMS, ATS and CRM check the organisation on the records each request returns.
Suntel360 · Security
Built for a security review
The questions procurement asks, answered on one page you can forward. No assurance certifications are claimed anywhere on this site, and no control below names a vendor or a version — that detail goes to your reviewers directly.
- Every request scoped to your organisation
- Access re-checked on every request, not cached into a token
- Written for procurement, not for a search engine
9
Security controls
4
Products covered
1
Shared engineering standard
1
Cross-product integration
Isolate
Tenant isolation in the access path: tenant-scoped storage keys in ERP, and an organisation check on every record returned in HRMS, ATS and CRM.
Verify
Role-based access control resolved fresh on every request. An access change takes effect immediately rather than at next sign-in. ATS has no login of its own — it authenticates every request against HRMS employee records.
Audit
Changes written to a dedicated audit log in HRMS, ATS and CRM. Immutable posted documents in ERP. Server-side document visibility in HRMS. No suite-wide login.
Controls
What is enforced, and where
Described by what it guarantees rather than by what it is built on. Your reviewers get the implementation detail from us in writing.
Role-based access control
In ERP, HRMS and CRM, permissions resolve fresh on every request against the user's assigned role, so an access change takes effect immediately rather than at next sign-in.
Fully managed infrastructure
Every product runs on managed cloud compute and storage, defined in version-controlled templates. There is no server for your team to patch.
Least-privilege service access
Each product's backend is granted access to its own tables and file storage, not broad account-wide access. The one cross-product grant serves the ATS and HRMS integration.
Audit trails kept apart from the record
In HRMS, ATS and CRM, changes are written to a dedicated audit log rather than inferred from a row's current state, so who did what survives later edits to the same record.
Immutable posted documents
In ERP, a submitted document cannot be edited. Corrections are made by cancelling and superseding, so a financial record's history cannot be rewritten in place.
Server-side document visibility
HRMS employee documents carry public, private and HR-only classifications checked on the server against the requesting user. A direct request for a document someone should not see is refused.
No suite-wide login
There is no suite-wide identity. Each product authenticates its own users, except ATS, which deliberately has no user store and defers to HRMS employee records.
Encrypted in transit and at rest
Traffic to the products is encrypted, and stored data is encrypted at rest by default rather than as an option someone has to remember to switch on.
Security Domains
Document and control types across the estate
Implementation detail for each control is available to your reviewers on request.
TENANTRBACAUDITENCRYPTINFRADOCSTENANTRBACAUDITENCRYPTINFRADOCS
1
Design
Every product is built with tenant isolation and role-based access as first-class concerns, and HRMS, ATS and CRM keep a dedicated audit log.
2
Deploy
Products defined in version-controlled templates and run on managed cloud compute and storage.
3
Operate
Access re-checked on every request. Changes written to dedicated audit logs in HRMS, ATS and CRM. Encrypted in transit and at rest by default.
4
Review
Procurement-ready documentation available on request. Your reviewers get implementation detail in writing, under NDA if needed.
Ask us directly
What this page deliberately does not answer
These depend on your deployment and your requirements, so publishing a generic answer would be worse than none. Bring them to the first security call and you will get specifics.
- Data residency and the region your organisation runs in
- Backup, retention and restore procedures
- Penetration testing history and remediation practice
- Incident response and notification commitments
- Sub-processor list and vendor due diligence
- Our infrastructure topology, in detail, under NDA
- Your own security questionnaire, completed by our team
- Session lifetime and sign-out controls
- Monitoring and alerting arrangements
WORKFLOW EVALUATION SESSION
Need our security documentation?
Tell us what your review requires — questionnaire, architecture session, or both — and we will send it.