This page describes, plainly, how we protect C.I.T. ERP and the data our customers trust us with. We've kept it to things that are actually true today rather than generic claims — if something below is unclear or you need more detail for a security review, email us.
Infrastructure
C.I.T. ERP sits behind Cloudflare, which fronts every request and absorbs volumetric and network-layer attacks before they reach our servers. The application server itself only accepts connections from Cloudflare's network — it isn't directly reachable from the open internet. All traffic is encrypted end-to-end over HTTPS.
On top of that, the application itself rate-limits sensitive endpoints (login, signup, two-factor verification) to slow down automated abuse, and repeated failed logins trigger an escalating, automatic lockout.
Data isolation between businesses
C.I.T. ERP is multi-tenant: every business that signs up gets its own separate database schema. Your customer records, financial data, and staff information are not stored in shared tables alongside other businesses' data — they live in a database space that only your account's requests can reach. A member of one business cannot query, export, or otherwise see another business's records through the application.
Authentication
Passwords are hashed, never stored in plain text. Two-factor authentication (an authenticator app or a one-time email code) is available on every account and can be required for specific users. Sessions expire automatically after a period of inactivity, and users can see and revoke their own active sessions from their account settings.
How we find and fix problems
We run our own internal security reviews across the application on an ongoing basis — authentication, permissions, data access, and infrastructure configuration — and fix what they turn up. We don't currently commission independent third-party penetration tests; that's a gap we're aware of, not something we're glossing over, and it's on our roadmap.
Backups
Account data is backed up daily, with backups retained for 30 days by default.
Reporting a vulnerability
If you believe you've found a security issue in C.I.T. ERP or on citsvc.com, please email [email protected] with details and, if possible, steps to reproduce it. We ask that you give us a reasonable chance to investigate and fix an issue before disclosing it publicly, and that you don't access, modify, or delete data that isn't your own while testing. We won't take legal action against good-faith reports made this way.
Questions
For anything not covered here — including a security questionnaire for a procurement review — email [email protected] or message us on WhatsApp +233 26 234 6523. See also our Privacy Policy.