Your data, protected at every layer
Enterprise-grade security is not an add-on — it's built into the foundation of Inflexions.
Infrastructure
End-to-End Encryption
All connections encrypted with modern TLS protocols. Strict transport security enforced.
EU Cloud Hosting
Hosted in the EU (Paris region). Managed database with automated failover.
Enterprise Secret Management
Sensitive credentials stored with military-grade encryption at rest and in transit.
Automated Daily Backups
Daily backups with 7-day retention. Point-in-time recovery.
24/7 Monitoring
Automated monitoring and alerting. Health checks every 30 seconds.
Zero-Downtime Deployments
Health-check validated deployments with automatic rollback.
Data Isolation
Row-Level Tenant Isolation
Every query automatically scoped to your company.
Company-Scoped File Storage
Uploaded documents physically separated by tenant.
No Cross-Tenant Access
Even platform administrators cannot see your business data.
Scoped Uniqueness Constraints
Reference numbers include company scope for data integrity.
Authentication
Short-Lived Access Tokens
15-minute access tokens with 48-hour refresh. Minimizes exposure.
Token Rotation & Revocation
New token on each refresh, old one immediately revoked.
Secure Cookie Storage
HTTP-only cookies resistant to XSS and CSRF attacks.
Login Rate Limiting
5 attempts per minute per IP. Prevents brute-force attacks.
Account Lockout
Configurable lockout after failed attempts.
Session Management
View all sessions, revoke individually or logout all devices.
Inactivity Timeout
Automatic logout after configurable inactivity period.
Access Control
Granular Permissions
8 roles with precisely scoped permissions. Every access explicitly granted.
Fail-Closed Enforcement
Endpoints without explicit permission are denied by default.
Two-Tier Permission Model
Platform and company permissions never overlap.
Complete Audit Trail
Every operation logged with user, IP, timestamp, and field-level changes.
Compliance
EU Data Residency
All data hosted in the EU. Never leaves Europe.
GDPR-Ready
Data export, deletion, and audit logs for proof of data handling.
Tunisian Compliance
PCT accounting standard built natively. 3-decimal TND support.
Immutable Audit Logs
Records cannot be edited or deleted. Meets financial regulations.
Data Retention
Soft-delete architecture for compliance. Configurable retention policies.
Encrypted Backups
Military-grade encryption at rest. Recovery procedures tested.
Questions about our security?
We take security seriously. Contact us for our detailed security whitepaper.