Role-based access control
Every route and every action requires an explicit permission — enforced on the server, not just hidden from the menu.
Enterprise security & access control
Access control
isn't a feature.
Openbiznis was built on the assumption that not everyone should see everything — and that assumption is enforced at every layer, not just the interface. Hiding a menu item is not security. Refusing the query is.
Step-up MFA
Sensitive roles and sensitive actions require a second verification step before they're allowed to proceed.
Row-level data isolation
Database-level policies ensure a user's queries only ever return data they're actually permitted to see.
Full audit trail
Every meaningful change is logged and reviewable — who did what, and when.
CEO-exclusive credential vault
Shared company credentials, access-controlled and MFA-gated behind the CEO role — not a spreadsheet, not a group chat.
Safe demo mode
New team members can be trained on a fully populated demo environment before they ever touch live data.
Defence in depth
Enforced at every layer.
A permission check in the browser is a convenience. A permission check in the database is a guarantee. Openbiznis does both, in that order of importance.
-
Interface
Navigation and actions the role can't use are never rendered, so the product stays legible.
-
Server
Every route re-checks the permission before doing any work — a crafted request gets refused, not served.
-
Database
Row-level policies scope the query itself, so even a bug upstream can't return another user's rows.
-
Audit
What did happen is recorded and reviewable, independently of what was permitted.
Data protection
Built for EU operators.
GDPR-aligned by design
Data minimisation, purpose limitation, and deletion workflows are part of the product, not a policy PDF. See our Privacy Policy.
A DPA, ready to sign
Openbiznis acts as processor for the customer data you put into it. Our Data Processing Agreement sets the terms.
Transparent sub-processors
Every third party that can touch customer data is listed, with its purpose and location, on our sub-processors page.
Questions from your security team?
Send them over. We'd rather answer them properly before you commit than after.