Security Policy

1. Scope

This policy describes the security measures Truebooks Information Systems LLP, offering its products under the brand and trademark Truebooks Business Solutions, applies to all Truebooks products (Truebooks ERP, SMB, Ecommerce, Logistics and courier, Construction and any other product, module or add-on) and to our websites. It applies to every tenant, whether the product was bought from us directly or through a channel partner, reseller or vendor. It should be read with the Terms and Conditions and the Privacy Policy.

2. Hosting and infrastructure

• The products, their applications and their databases are hosted on Microsoft Azure virtual machines (VMs).
• Database servers are not open to the internet. They accept connections only from our own application servers and authorised administration routes.
• Servers are kept up to date with security patches, and only the services each server needs are switched on.

3. Tenant isolation

Truebooks is a multi-tenant platform. Every record belongs to a tenant, and the application filters every request so that a tenant's users see only their own organisation's data. Where a tenant has several branches, sign-in is tied to a branch, and data can be restricted to that branch.

4. Encryption

• In transit: all traffic to our websites and products uses HTTPS with current TLS certificates.
• At rest: data is stored on Azure disks, which Azure encrypts at rest.
• Passwords are stored only as one-way hashes, never in plain text.
• Secrets such as API keys and service credentials are kept in a central, access-controlled vault, not in the application code.

5. Access control

• Users: each login is for one named person. Access to modules, screens and actions is controlled by roles that the tenant's administrator assigns.
• Administrators: only a tenant's administrator or owner can manage that tenant's users and accept terms for it.
• Truebooks staff: access to production servers, databases and the platform administration console is limited to authorised staff who need it for their work. The administration console is protected by two-factor authentication, account lockout after repeated failed sign-ins, and an audit log of administrative actions.
• Support access: our support team looks at a tenant's business data only where it is needed to resolve a request from that tenant, or to keep the Service running and secure.

6. Protection against misuse and automated access

• Sign-ins from automated browsers, scripts, bots and AI agents are refused, as the Terms and Conditions require.
• The pace and pattern of activity on each login are monitored, and unusual activity raises an alert to our team.
• The number of requests any one login can make is limited, so one user cannot slow the system down for others.
• Internal programming interfaces, technical documentation pages and software files that could be decompiled are not exposed to the public.
• Public forms are protected against automated submissions.

7. Monitoring and logging

We record security-relevant events, including sign-ins, failed sign-ins, the browser and device used, and administrative actions. These records are used to detect and investigate misuse, and are kept for as long as needed for that purpose. Monitoring looks at how the Service is used, not at the content of your business data.

8. Backup and recovery

• We take one backup a day of each tenant's database and of the applications. Data can be restored from the last backup taken.
• Tenants who need hourly or more frequent backups can ask for them, for an additional charge at the rate prevailing on the day.
• Backups are kept separately from the live system, and restores are carried out by authorised staff.
• Our responsibility for data held on the Azure platform is limited as set out in the Terms and Conditions.

9. Secure development and change management

• Changes to the products are made in source control and reviewed. They are tested on a separate development environment before they reach production.
• Production releases are carried out by authorised staff under a written deployment procedure, with a backup of the live system taken before each release.
• Platform updates and security fixes are applied to all tenants at once.

10. Payments

Card and bank payments are handled by the payment provider. Truebooks does not store full card numbers.

11. Incident response

If we detect or are told about a security incident, we will:

1. contain it and protect the affected systems and data;
2. investigate what happened and which tenants are affected;
3. tell the affected tenants without undue delay, and the authorities where the law requires;
4. fix the cause and take steps to prevent it happening again.

12. Your part in security

Security is shared between us and each tenant. Tenants should:

• keep passwords private, and never share a login between people or give it to a program;
• remove users promptly when they leave the organisation, and review user roles regularly;
• use only the approved ways to automate described in the Terms and Conditions;
• export and check their own data from time to time;
• tell us straight away if they suspect a login has been misused.

13. Reporting a vulnerability

If you believe you have found a security weakness in a Truebooks product or website, please email info@truebooksolutions.com with the details, and give us reasonable time to fix it before telling anyone else. Please do not access other people's data, disrupt the Service, or run automated scans against it.

14. Changes to this policy

This policy is subject to change as and when the management of the Company considers it necessary. The current version is always published at truebookserp.com/security with its "Last updated" date.