Security
Your customer data is the most sensitive thing you own.
Security is built into the application at every layer — authentication, authorisation, input handling, file uploads, logging and backup. Here is exactly what that means.
🔐
Authentication
Getting in should be hard for attackers and simple for your staff.
✓Passwords stored as one-way hashes, never in plain text
✓Two-factor authentication for staff and administrators
✓Login rate limiting and brute-force lockout
✓Secure, expiring password-reset links
✓Hardened session cookies with idle timeout
✓Optional single sign-on
🛡
Access control
Everyone sees exactly what their job requires — and nothing else.
✓Role-based access for admin, staff and client
✓Granular per-permission control on every action
✓Department-scoped visibility of tickets
✓Server-side permission checks, not hidden buttons
✓IP restrictions for administrative access
✓Separate client portal with no staff data
🧱
Application hardening
The common web attacks are handled at the framework level.
✓Parameterised queries throughout — SQL injection protection
✓Output escaping on every rendered value — XSS protection
✓CSRF tokens on every form and state-changing request
✓Strict Content-Security-Policy and security headers
✓File uploads type-checked, size-limited and scanned
✓Sensitive data masking in logs and exports
📋
Accountability & recovery
If something goes wrong, you can see what happened and get back.
✓Audit log of every administrative action
✓Activity log per staff member and per ticket
✓Automated database and file backups
✓Defined data-retention policy
✓HTTPS/SSL enforced on every request
✓Error and access logs retained for review