Encryption at rest
All four products
Stored data is encrypted with AES-256 by default, in the databases and in file storage. It is not an option someone has to remember to switch on.
Suntel360 · Security Measures
How security is implemented, not just promised
Each measure below names the products it applies to and was checked against the product code and live configuration. Topics we have not verified are listed under “Ask us directly” instead. No assurance certifications are claimed anywhere on this site.
- 6 security domains, each measure tagged with the products it covers
- Access checked on every request, not cached
- Written for procurement, not for a search engine
6
Security domains
18
Verified measures
4
Products covered
14
Questions for the security call
Isolate
Tenant isolation in the access path: tenant-scoped storage keys in ERP, and an organisation check on every record returned in HRMS, ATS and CRM.
Verify
Role-based access control resolved fresh on every request. An access change takes effect immediately rather than at next sign-in. ATS has no login of its own — it authenticates every request against HRMS employee records.
Audit
Changes written to a dedicated audit log in HRMS, ATS and CRM. Immutable posted documents in ERP. Server-side document visibility in HRMS. No suite-wide login.
Domain 01
Data protection
Stored data is encrypted by default, and every request is scoped to the organisation that made it.
Encryption in transit
All four products
Product APIs are served over HTTPS only. There is no plain-HTTP endpoint to fall back to.
Tenant-scoped storage keys
Applies to: ERP
Every ERP record is stored under its organisation's key, so a query is scoped to one organisation by construction.
Domain 02
Access and identity
Access is resolved and checked on the server, on every request.
Role-based access control
All four products
Permissions resolve fresh against a live role lookup on every request. An access change takes effect immediately rather than at next sign-in.
Server-side permission enforcement
All four products
No client-side-only access control. Every protected endpoint validates the caller's scope before returning data.
Least privilege for new users
Applies to: ERP · HRMS
New users start with the minimum role. In ERP a new member has no access until a role is assigned; in HRMS new employees start as Employee, and role changes are logged.
No suite-wide login
All four products
There is no suite-wide login. ERP, HRMS and CRM authenticate their own users; ATS keeps no user store and authenticates recruiters against HRMS employee records.
Scoped service permissions
All four products
Each product's backend is granted access to that product's own tables and file storage. The one cross-product grant serves the ATS and HRMS integration.
Domain 03
Infrastructure
Managed infrastructure, so there is no server for your team to run.
Managed cloud compute
All four products
All products run on managed cloud compute and storage. There is no server for your team to patch or harden.
Provider-patched runtime
All four products
The application runtime is a managed environment that the provider keeps patched.
Gateway request throttling
Applies to: ERP · CRM
The ERP and CRM APIs cap the request rate at the gateway, before a request reaches application code.
Domain 04
Application security
Input is checked on the server, and errors do not leak internals.
Input validation
All four products
All user input is validated against expected schemas on the server, and unknown fields are rejected. Client-side validation is never trusted.
Error handling
All four products
Users get generic error messages. Detailed error context is logged on the server only.
Output encoding
Applies to: ATS · CRM
Dynamic content is encoded before it is rendered, to prevent injection.
Immutable posted documents
Applies to: ERP
A submitted ERP document cannot be edited. Corrections are made by cancelling it, which posts a reversal, and amending a new version.
Domain 05
Audit
Who did what is recorded apart from the records themselves.
Dedicated audit logging
Applies to: HRMS · CRM
Significant actions are written to a separate audit log that records who, what, when and from where.
Read-only audit trail
Applies to: HRMS · CRM
Audit entries cannot be edited or deleted through the product; the audit interfaces only read.
Domain 06
Recovery
What can be restored today, product by product.
Point-in-time recovery
Applies to: ERP
ERP database tables keep continuous backups, restorable to any point in the last 35 days.
1
Design
Every product is built with tenant isolation and role-based access as first-class concerns, and HRMS, ATS and CRM keep a dedicated audit log.
2
Deploy
Products defined in version-controlled templates and run on managed cloud compute and storage.
3
Operate
Access re-checked on every request. Changes written to dedicated audit logs in HRMS, ATS and CRM. Encrypted in transit and at rest by default.
4
Review
Procurement-ready documentation available on request. Your reviewers get implementation detail in writing, under NDA if needed.
Ask us directly
What this page does not answer
These depend on your deployment and your requirements, so publishing a generic answer would be worse than none. Bring them to the first security call and you will get specifics.
- Backup schedules, retention and restore testing for each product
- Data residency and the region your organisation runs in
- Incident classification, customer notification and post-incident review
- Session lifetime and sign-out controls
- Secrets handling and rotation
- Dependency and vulnerability scanning
- Monitoring, alerting and on-call arrangements
- Access reviews, change management and written security policies
- Exact cipher suites and TLS configurations in use
- Penetration testing scope, frequency, and remediation SLA
- Your organisation's specific compliance questionnaire
- Detailed infrastructure topology under NDA
- Sub-processor security attestations
- Audit log retention periods and export formats
WORKFLOW EVALUATION SESSION
Need our security measures documented?
Tell us what your review requires — control mapping, architecture session, or evidence package — and we will send it.