Security & Enterprise Architecture
evo7 applies authentication constraints, database audit layers, and an isolated microservices architecture to protect your business operations. The controls described on this page are the ones we have built; where something is not yet verified in production we say so.
Security & Access Controls
Time-Bound, Short-Lived Sessions
Client sessions use short-lived JSON Web Tokens backed by rotating refresh tokens, with server-side session revocation so access can be withdrawn immediately.
Automated CRUD Audit Trail
Create, update and delete actions on audited CRM, Billing, Stock and Support entities are written to an append-only audit trail recording user identity and state changes. Sensitive fields are redacted before the record is stored.
PII Masking in Logs
Log output passes through pattern-based masking for identifiers such as email addresses and phone numbers. Masking is applied to string content; structured object fields rely on a maintained redaction list, so coverage is good rather than absolute.
Scalable Enterprise Architecture
Designed to scale horizontally, with customer data isolation enforced at the data-access layer rather than by convention.
Unified API Gateway
All requests route through a single entrance gateway that enforces security checks, rate limiting, and routing logic before hitting background systems.
Event-Driven Real-Time Sync
Services communicate via asynchronous, isolated message queues. If one module goes offline, events queue safely and execute automatically on recovery.
Isolated Customer Data
Each customer's data is isolated logically, with PostgreSQL row-level security enforced in migrations and validated in CI. This has not yet been re-verified against a populated production database.
Our Security Commitment
The availability target our containerized architecture is designed for. This is a design target, not a measured historical figure and not a contractual SLA — contractual service levels are agreed per customer.
Time-based one-time-password MFA and WebAuthn passkeys are available and can be required per organization and per role.
Platform data is hosted on infrastructure located in India. Website analytics, bot protection and several product integrations use vendors that process outside India — see our sub-processor register and Privacy Policy.
What we do not claim
- evo7 holds no SOC 2, ISO 27001 or equivalent third-party attestation, and makes no such claim.
- TLS is terminated at the platform edge. Encryption of internal service-to-service and database traffic is in progress, not complete.
- Database and disk encryption at rest, and an offsite disaster- recovery region, are planned rather than in place. Daily backups with a tested restore path do exist.
- Selected fields (KYC identifiers, bank details, MFA secrets) use application-level AES-256-GCM encryption; this becomes effective once the encryption key is provisioned to each service.
DPDP Act, 2023 — what we've built
The Digital Personal Data Protection Act has no third-party certification scheme, so we do not claim to be "DPDP certified." What we have implemented against it:
- Consent-based lawful processing (s.6) recorded against every lead, demo, and download request.
- A Grievance Officer process (s.13) for rights and complaints, with a committed response window.
- Data subject rights: access, correction, erasure, and nomination of a representative.
- Defined retention periods, with records deleted or irreversibly anonymised once no longer needed.
- A public sub-processor register disclosing every vendor that touches personal data outside our own systems.
Role-Based Access & Admin Controls
Enterprise administrators maintain full governance over which users can access which platform capabilities — enforced at the API layer, not just the UI.
Role-Based Access Control (RBAC)
Authorisation is enforced at the API layer rather than in the UI: endpoints carry an explicit access decorator and the requesting user's role is checked before the handler runs. Roles (ADMIN, MANAGER, ENGINEER, VIEWER) map to granular permission sets across CRM, Billing, Projects, and Stock.
Organisation Profile & User Management
Admin users manage their organisation's profile, logo, GST details, and operational regions. User provisioning, password resets, and access revocation are all handled from a central admin console.
Have a security question before you commit?
We are happy to walk your IT or compliance team through the architecture, data handling and access model in detail.