Security Policies¶
ERP Plus follows a security-first approach.
Core Principles¶
Least Privilege¶
Users and services should only have the permissions they require.
Defense in Depth¶
Security must exist at:
- application layer
- infrastructure layer
- deployment layer
Auditability¶
Critical actions must be traceable.
Examples:
- deployments
- account changes
- permission changes
Multi-Tenancy Isolation¶
Data belonging to one organization must never be exposed to another.
Secure Defaults¶
Security should be enabled by default, not added later.