CrineonERP
Book a demoMessage us on WhatsApp

Security

Your data, protected at every layer.

How CrineonERP is hosted, who can see what, and what we do to keep it safe. Written for the IT reviewer who will vet us, and the director who signs.

Request security documents
  1. Layer 3 · Your organisationYouWho has accounts, their roles, approval thresholds, sign-in policies
  2. Layer 2 · Application and serviceCrineonThe CrineonERP software, configuration, backups, monitoring, support access
  3. Layer 1 · InfrastructureHosting providerData centres, servers, network, physical security

Hosting assurance

Certified infrastructure, from the makers of the foundation.

CrineonERP runs on Frappe Cloud, the managed platform operated by Frappe Technologies, the company behind ERPNext and the Frappe Framework that CrineonERP is built on. Reports are available to customers on request, under NDA.

  • ISO/IEC 27001:2022Information security management, certified.
  • ISO 9001:2015Quality management, certified.
  • SOC 2 Type IIA current report on security, availability and confidentiality controls.

These certifications belong to the hosting provider, and we recheck them every year. Crineon does not claim them for itself.

Data protection and privacy

Your data stays yours.

Roles
Crineon acts as data processor; your company is the data controller.
Agreement
A data processing agreement, including cross-border transfer terms, with every contract.
Location
Your company’s site is hosted in a region confirmed in your contract.
Separation
Each company has its own site and its own database. No other company’s records are stored in it.
Regulator
Registered with the Nigeria Data Protection Commission.
Leaving
Every report exports to Excel at any time, and the agreement sets out how we return your data.

Application security

Who can see what, and who did what.

  • Microsoft 365 sign-in

    Under your own MFA and Conditional Access policies. Companies not on Microsoft 365 sign in with a password and two-factor authentication.

  • Joiners and leavers

    Handled from your Microsoft 365 groups. Remove someone from a group and their access goes on the next sync.

  • Roles to document level

    Each person sees only what their job needs, down to the type of document.

  • Full audit trail

    Version history on records; submitted records change only by amendment.

  • No self-approval

    Approvals by amount, and nobody approves their own request.

  • Encrypted in transit

    HTTPS everywhere, for every user and every integration.

Data resilience

Recovery that doesn’t depend on one provider.

  • DailyAutomated backups
  • 30 daysRetention
  • Off-siteA copy held independently of the host
  • QuarterlyRestore tested, not assumed

How we build

Every change is tested before it reaches you.

  • The core is never modified

    ERPNext and the Frappe Framework stay as released. Everything CrineonERP adds is a separate, tested app, which keeps it upgradeable.

  • Reviewed and tested

    Every change is code-reviewed and passes automated tests before release.

  • Kept up to date

    Dependencies are updated regularly, and fixes reach you as part of each release.

  • Access only when needed

    Crineon staff reach a customer’s system only when support needs it.

This website

Hosted apart from CrineonERP.

This marketing site runs on Cloudflare, separately from CrineonERP and your records. It sets no advertising or tracking cookies.

For your IT reviewer

Request security documents

  • Our completed security questionnaire
  • The data processing agreement
  • The hosting provider’s reports, under NDA
Request documents

Responsible disclosure

Found a vulnerability?

Tell us at the address below. We’ll acknowledge your report, keep you informed and won’t pursue good-faith research.

info@crineonerp.com

Disclosure policy

See CrineonERP running your workflows.

Tell us how your company works. We’ll show you the same processes in CrineonERP, using your approval chain and your documents.

Book a demo