Security and continuity
This document summarizes the security controls available in Soltechn ERP and the shared responsibility between Soltechn and each organization. Specific hosting, backup, recovery, and availability commitments are those defined in the applicable proposal or agreement.
Shared responsibility model
Soltechn protects the platform and hosting components it manages. Each organization protects its users, devices, permissions, integrations, uploaded data, and internal processes. In customer-managed installations, the customer is also responsible for infrastructure, updates, and backups.
Identity and access control
The platform provides roles, action-based permissions, company and branch separation, multi-factor authentication, session controls, and event logs. The organization should apply least privilege and review access when a person changes roles or leaves the company.
Application and data protection
Soltechn applies access checks, logical isolation, traceability for critical actions, and controls to reduce exposure of sensitive information. Encryption, network, and physical protection also depend on the contracted hosting environment.
No system can guarantee zero risk; controls are reviewed and adjusted based on vulnerabilities, technical changes, and observed incidents.
Backups, recovery, and availability
Backup frequency, retention, location, restoration tests, recovery objectives, and availability are defined for each deployment model and in the applicable commercial agreement.
The organization should maintain additional exports or backups when required by its regulations, risk tolerance, or continuity plan.
Incident management
Reported events are assessed to contain risk, preserve evidence, correct the cause, and restore service. When a confirmed incident affects a customer, the known scope, measures taken, and recommended actions will be communicated as the investigation progresses.
Responsible vulnerability disclosure
Anyone identifying a potential vulnerability should report it privately to the official email, explain how to reproduce it, and avoid accessing, modifying, or disclosing third-party data. Destructive testing, denial of service, social engineering, and publication before coordinating a fix are not permitted.
Providers and periodic review
Providers involved in hosting, communications, storage, or support must limit processing to the contracted service. The applicable list and locations may vary by deployment and can be requested through the official contact channel.
Soltechn reviews its controls in proportion to risk and may update this document when the architecture, providers, or applicable obligations change.