Effective Date: April 17, 2026 Last Updated: April 17, 2026 Company Name: ERP Group Website: www.erpgroup.in Platform: India's AI-Powered GST Billing & Cloud ERP Platform

Security Compliance — ERP Group

At ERP Group, security is not a feature — it is the foundation on which everything we build rests. When you trust ERP Group with your business's financial records, GST data, employee payroll information, customer details, and operational data, you are trusting us with some of the most sensitive information your business possesses.

This Security Compliance page explains in complete detail how ERP Group protects your data — the technical measures we implement, the organisational policies we enforce, the compliance certifications we maintain, the regulatory frameworks we adhere to, and the processes we follow to ensure your business data remains secure, private, and available whenever you need it.

We believe every ERP Group customer — from a solo trader in Rajasthan to a multi-branch manufacturing company in Maharashtra — deserves to know exactly how their data is protected. This page is our commitment to that transparency.

1. Our Security Philosophy

1.1 Security as a Core Business Value

ERP Group was built with security embedded at every layer of its architecture — not added as an afterthought. Our engineering team follows a security-first development philosophy that treats every new feature, every code change, and every infrastructure modification as a potential security concern that must be evaluated, tested, and validated before deployment.

We operate on the principle of Zero Trust Security — the assumption that no user, device, network, or system should be automatically trusted, regardless of whether it is inside or outside our infrastructure perimeter. Every access request is verified. Every transaction is authenticated. Every data transfer is encrypted. Every system is continuously monitored.

1.2 Shared Security Responsibility

Security at ERP Group is a shared responsibility between our platform and our customers. ERP Group is responsible for securing the infrastructure, application, and data storage layers of our platform. Our customers are responsible for maintaining the security of their account credentials, managing user access permissions appropriately, and ensuring that devices used to access the platform are secure.

This Security Compliance page describes ERP Group's responsibilities in detail. Our Terms & Conditions at www.erpgroup.in/terms-and-conditions describe customer responsibilities.

1.3 Continuous Security Improvement

The threat landscape evolves constantly. New vulnerabilities are discovered. Attack techniques become more sophisticated. Regulatory requirements change. ERP Group's security programme is not static — it is a continuously evolving commitment that incorporates new security technologies, updated compliance frameworks, and lessons learned from the broader security community.

2. Data Encryption — Protecting Your Data at Every Stage

2.1 Encryption in Transit

All data transmitted between your device and the ERP Group platform — including login credentials, financial transactions, GST data, payroll information, and all other business data — is encrypted using Transport Layer Security (TLS) version 1.2 or higher with strong cipher suites.

What This Means for Your Data

Every piece of data that travels between your browser or mobile app and ERP Group's servers is encrypted into an unreadable format that can only be decrypted by the intended recipient. Even if a malicious actor were to intercept your data in transit — through a man-in-the-middle attack or network eavesdropping — they would see only meaningless encrypted data, not your financial records or business information.

HTTPS Enforcement

ERP Group enforces HTTPS on all pages of its website and platform — with HTTP Strict Transport Security (HSTS) headers that instruct browsers to always use encrypted connections. Attempts to access ERP Group using unencrypted HTTP are automatically redirected to HTTPS. ERP Group's SSL certificates are issued by trusted Certificate Authorities and are renewed automatically to ensure uninterrupted encrypted connectivity.

API Security

All API connections — including integrations with the GSTN portal, banking partners, payment gateways, and third-party services — use encrypted TLS connections with certificate validation. API authentication uses secure token-based mechanisms that prevent unauthorised access to your data through API channels.

2.2 Encryption at Rest

All customer data stored on ERP Group's servers — including financial records, GST data, payroll information, documents, and all other business data — is encrypted at rest using Advanced Encryption Standard with 256-bit keys (AES-256).

Database Encryption

ERP Group's primary databases use transparent data encryption — automatically encrypting data as it is written to disk and decrypting it when accessed by authorised processes. Encryption keys are managed through a dedicated key management system that is physically and logically separated from the encrypted data.

File Storage Encryption

Documents, attachments, invoice PDFs, and other files uploaded to or generated by the ERP Group platform are stored in encrypted object storage — with each file encrypted individually using unique encryption keys, providing an additional layer of protection beyond database-level encryption.

Backup Encryption

All backup copies of your data — discussed in detail in Section 6 — are encrypted using the same AES-256 standard as primary data storage. Backup encryption ensures that even if backup media were compromised, your data would remain protected.

2.3 Encryption Key Management

ERP Group uses a dedicated, hardware-backed key management system to generate, store, rotate, and retire encryption keys. Encryption keys are never stored in plain text alongside encrypted data. Key rotation is performed regularly to limit the potential impact of key compromise. Access to encryption keys is restricted to authorised cryptographic processes and is subject to strict access controls and comprehensive audit logging.

3. Access Control & Authentication

3.1 Multi-Factor Authentication

ERP Group supports and strongly recommends Multi-Factor Authentication (MFA) for all user accounts. MFA requires users to provide a second form of verification — in addition to their password — when logging into the platform. This means that even if a user's password is compromised, an attacker cannot access the account without also controlling the second factor.

Supported MFA Methods

ERP Group supports the following MFA methods for account authentication — Time-based One-Time Password (TOTP) via authenticator apps such as Google Authenticator and Microsoft Authenticator, SMS-based OTP delivery to the registered mobile number, and email-based OTP for accounts without a registered mobile number.

MFA for Administrator Accounts

MFA is mandatory for all administrator-level accounts on the ERP Group platform — accounts with the ability to manage users, modify system settings, or access sensitive financial data. Administrators who attempt to log in without completing MFA will be denied access.

3.2 Role-Based Access Control

ERP Group's platform implements granular Role-Based Access Control (RBAC) — ensuring that every user can access only the data and features that their role requires, and nothing more.

Predefined Roles

ERP Group provides predefined roles covering common business user types — System Administrator, Accountant, GST Manager, HR Manager, Warehouse Manager, Sales Executive, CA/Accountant (External), and View-Only Auditor — each with carefully defined permission sets appropriate to the role's responsibilities.

Custom Role Configuration

Account administrators can create custom roles with precise permission configurations — specifying exactly which modules, features, and data categories each role can access, create, edit, or delete. This granular permission system ensures the principle of least privilege is applied throughout your ERP Group account.

User Access Reviews

ERP Group's platform provides account administrators with a complete user access report — listing all active users, their assigned roles, last login date, and access permissions — enabling regular access reviews to identify and revoke unnecessary access privileges.

3.3 Session Management

Automatic Session Timeout

ERP Group automatically terminates inactive sessions after a configurable period of inactivity — defaulting to 30 minutes for standard users and 15 minutes for administrator accounts. This automatic timeout prevents unauthorised access through unattended, logged-in devices.

Device Management

ERP Group's "Remember this device for 30 days" feature uses a secure device token — stored as an encrypted cookie — to authenticate recognised devices without requiring full MFA on every login. Users can view all remembered devices from their account security settings and revoke device trust for any device at any time.

Concurrent Session Controls

ERP Group monitors concurrent login sessions and alerts users when their account is accessed from a new device or location. Users can remotely terminate any active session from their account security dashboard — immediately logging out any device accessing their account.

3.4 Password Security

Password Requirements

ERP Group enforces strong password requirements — minimum 8 characters including at least one uppercase letter, one lowercase letter, one number, and one special character. Common passwords and passwords that appear in known breach databases are rejected automatically.

Password Storage

ERP Group never stores passwords in plain text. All passwords are hashed using industry-standard bcrypt hashing with a high cost factor — making brute-force attacks computationally impractical even if hashed password data were ever compromised.

Password Reset Security

Password reset requests are processed through a time-limited, single-use reset link sent to the registered email address. Password reset links expire after 60 minutes. ERP Group never sends passwords via email or SMS — only secure reset links.

4. Infrastructure Security

4.1 Cloud Infrastructure & Data Localisation

ERP Group's platform is hosted on enterprise-grade cloud infrastructure located entirely within India — complying with India's data localisation requirements and ensuring your business data never leaves Indian territory without your explicit authorisation.

Indian Data Centres

ERP Group uses Tier III and Tier IV certified data centres located in India — with redundant power supply, redundant cooling systems, multiple network connections, physical security controls, and 24/7 on-site security personnel. These facilities are designed and operated to the highest standards of physical infrastructure security.

Geographic Redundancy

ERP Group maintains its infrastructure across multiple geographically separated data centre locations within India — ensuring that a disaster or infrastructure failure at any single location does not result in data loss or extended service unavailability.

4.2 Network Security

Firewall Protection

ERP Group's infrastructure is protected by multiple layers of firewalls — network-level firewalls controlling traffic between infrastructure zones, application-level firewalls filtering traffic at the web application layer, and host-based firewalls on individual servers. Firewall rules are reviewed and updated regularly by our security team.

DDoS Protection

ERP Group implements enterprise-grade Distributed Denial of Service (DDoS) protection — absorbing and mitigating volumetric, protocol, and application-layer DDoS attacks that could otherwise disrupt platform availability. Our DDoS mitigation capacity far exceeds the traffic volumes typically seen in attacks targeting Indian SaaS platforms.

Intrusion Detection & Prevention

ERP Group's network is continuously monitored by automated Intrusion Detection and Prevention Systems (IDS/IPS) — analysing network traffic in real time for patterns that indicate malicious activity, automatically blocking suspicious traffic, and alerting our security team to potential threats for immediate investigation.

Web Application Firewall

ERP Group deploys a Web Application Firewall (WAF) in front of all customer-facing services — filtering and monitoring HTTP traffic between the internet and our application servers to protect against common web application attacks including SQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF), and other OWASP Top 10 vulnerabilities.

4.3 Server & Application Security

Hardened Server Configuration

All ERP Group servers are configured according to industry security hardening standards — with unnecessary services disabled, default credentials changed, unnecessary software removed, and all security patches applied promptly. Server configurations are documented, version-controlled, and regularly audited against security benchmarks.

Vulnerability Management

ERP Group operates a continuous vulnerability management programme — using automated vulnerability scanning tools to regularly assess all servers, applications, and network infrastructure for known vulnerabilities. Critical vulnerabilities are patched within 24 hours of identification. High-severity vulnerabilities are patched within 7 days.

Penetration Testing

ERP Group engages qualified third-party security professionals to conduct comprehensive penetration testing of the platform — simulating real-world attack scenarios to identify vulnerabilities that automated scanning may miss. Penetration tests are conducted at least annually and after significant platform architecture changes.

Secure Software Development Lifecycle

ERP Group's development team follows a Secure Software Development Lifecycle (SSDLC) — integrating security review at every stage of software development from design through deployment. Security requirements are defined at the design stage. Code is reviewed for security vulnerabilities before merging. Automated security testing is run as part of the continuous integration pipeline. Security validation is performed before every production deployment.

5. Application Security

5.1 Protection Against Common Vulnerabilities

ERP Group's application is built with specific protections against the most common categories of web application vulnerabilities as identified by the OWASP Top 10:

SQL Injection Prevention

All database queries in ERP Group's application use parameterised queries and prepared statements — preventing attackers from injecting malicious SQL code through user input fields. Input validation and sanitisation provides an additional layer of protection against injection attacks.

Cross-Site Scripting (XSS) Prevention

ERP Group's application uses output encoding and Content Security Policy (CSP) headers to prevent cross-site scripting attacks — ensuring that user-supplied content is never executed as code in the browser.

Cross-Site Request Forgery (CSRF) Prevention

All state-changing operations in ERP Group's application require a valid CSRF token — preventing attackers from tricking authenticated users into performing unintended actions through malicious websites.

Broken Authentication Prevention

ERP Group implements secure session management, strong password policies, MFA support, account lockout after failed login attempts, and secure password reset processes — addressing the authentication vulnerabilities that are among the most commonly exploited in web applications.

5.2 API Security

Authentication & Authorisation

All ERP Group API endpoints require authentication using secure bearer tokens. Every API request is authorised against the requesting user's role and permissions — ensuring API access is subject to the same RBAC controls as user interface access.

Rate Limiting

ERP Group's APIs implement rate limiting — restricting the number of requests any single client can make within a defined time window. Rate limiting prevents both brute-force attacks and unintentional denial of service from poorly designed integrations.

API Audit Logging

All API access — including every request, the authenticated user, the requested resource, and the response — is logged for security monitoring and audit purposes. API audit logs are retained for 12 months and are available to account administrators through the platform's audit log interface.

5.3 Audit Trails & Transaction Logging

ERP Group maintains comprehensive audit trails for all significant actions performed within the platform — recording the user who performed each action, the timestamp, the affected records, the previous and new values, and the IP address from which the action was performed.

Financial Transaction Audit Trail

Every financial transaction — invoice creation, payment recording, journal entry, bank reconciliation, and GST filing — is logged with a complete, tamper-proof audit trail. Financial audit trails cannot be deleted or modified by any user — including administrators — ensuring the integrity of your financial records for accounting, audit, and legal purposes.

User Activity Log

A complete log of every user's activity on the platform — logins, logouts, record creation, modification and deletion, report generation, and settings changes — is maintained and available to account administrators for security review and compliance purposes.

6. Data Backup & Recovery

6.1 Automated Backup Schedule

ERP Group performs automated backups of all customer data on the following schedule:

6.2 Backup Storage & Security

All backups are stored in geographically separated locations from primary data — ensuring that a disaster affecting a primary data centre does not simultaneously destroy backup copies. Backups are encrypted using AES-256 before storage and are accessible only to authorised ERP Group operations personnel through multi-factor authenticated access.

6.3 Recovery Testing

ERP Group regularly tests its backup and recovery processes — performing scheduled restoration tests to verify that backed-up data can be successfully restored within the expected recovery time. Recovery test results are documented and reviewed by the security team. Any issues identified during recovery testing are remediated before the next scheduled test.

6.4 Recovery Time Objectives

ERP Group targets the following recovery objectives for its platform:

7. Compliance Certifications & Standards

7.1 ISO 27001 — Information Security Management

ERP Group's information security management system is built in alignment with the ISO/IEC 27001 standard — the internationally recognised framework for information security management. ISO 27001 alignment means ERP Group has implemented a systematic, risk-based approach to managing information security — covering people, processes, and technology across all aspects of our operations.

What ISO 27001 Alignment Means for Your Data

Our ISO 27001 aligned security management system includes a formal information security policy, systematic identification and treatment of information security risks, security awareness training for all employees, defined incident response and business continuity procedures, and regular internal and external security audits to verify compliance with security controls.

7.2 AES-256 Encryption Standard

ERP Group uses AES-256 (Advanced Encryption Standard with 256-bit keys) — the encryption standard used by governments, military organisations, and financial institutions worldwide for protecting sensitive data. AES-256 is considered computationally unbreakable with current and foreseeable technology — providing the highest level of encryption protection available for your business data.

7.3 TLS 1.2/1.3 — Transport Layer Security

All data transmitted to and from ERP Group's platform is protected using TLS 1.2 or TLS 1.3 — the current industry standard for encrypted data transmission. ERP Group does not support older, insecure SSL and TLS versions (SSL 3.0, TLS 1.0, TLS 1.1) that contain known vulnerabilities.

7.4 GSTN Security Compliance

ERP Group's integration with India's GSTN portal complies with all security requirements specified by the Goods and Services Tax Network for authorised API service providers — including secure API authentication, encrypted data transmission, and audit logging of all GSTN API interactions.

7.5 Indian Regulatory Compliance

Information Technology Act 2000

ERP Group's security practices comply with the security provisions of India's Information Technology Act 2000 — including the requirements for reasonable security practices and procedures specified under Section 43A.

IT (Reasonable Security Practices) Rules 2011

ERP Group's security programme is designed to meet the standards specified in the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 — which define the minimum security standards for organisations handling sensitive personal data in India.

Digital Personal Data Protection Act 2023

ERP Group's security and privacy practices are designed to comply with India's Digital Personal Data Protection Act 2023 (DPDPA) — including requirements for appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, and destruction.

GST Act 2017 — Data Security for Tax Records

ERP Group's data retention and security practices ensure that all GST-related records are maintained securely for the periods required under the GST Act 2017 — protecting the integrity and availability of your tax records for audit and compliance purposes.

8. Security Monitoring & Incident Response

8.1 Continuous Security Monitoring

ERP Group operates a 24/7 security monitoring programme — continuously analysing platform activity, network traffic, system logs, and application events for indicators of security threats, anomalous behaviour, and potential incidents.

Security Information and Event Management

ERP Group uses a Security Information and Event Management (SIEM) system — aggregating security event data from all platform components, correlating events across systems, and automatically alerting the security team to potential threats that require investigation.

Anomaly Detection

ERP Group's monitoring systems use behavioural analytics to establish baseline patterns of normal activity — automatically flagging deviations that may indicate compromised accounts, insider threats, or external attacks. Anomaly detection covers user behaviour, API usage patterns, data access patterns, and network traffic characteristics.

8.2 Security Incident Response

Incident Response Plan

ERP Group maintains a formal, tested Security Incident Response Plan — defining the procedures for identifying, containing, eradicating, and recovering from security incidents of all categories and severities. The plan assigns specific responsibilities to team members, defines communication protocols, and specifies escalation paths for different incident types.

Incident Classification

ERP Group classifies security incidents into four severity levels — Critical, High, Medium, and Low — with defined response time targets for each:

Customer Notification

In the event of a security incident that affects your data, ERP Group will notify you via email at the address registered with your account within 72 hours of becoming aware of the incident — providing information about the nature of the incident, the data potentially affected, the measures taken to contain and remediate the incident, and the steps we recommend you take to protect your account.

8.3 Vulnerability Disclosure

ERP Group operates a responsible vulnerability disclosure programme — welcoming reports of security vulnerabilities from security researchers, customers, and the broader security community. If you discover a potential security vulnerability in ERP Group's platform, please report it responsibly to [email protected].

We commit to acknowledging your report within 48 hours, providing regular updates on the investigation and remediation progress, and not taking legal action against researchers who discover and report vulnerabilities responsibly in accordance with our disclosure guidelines.

9. Employee Security & Training

9.1 Security Screening

All ERP Group employees and contractors who have access to customer data or production systems undergo background verification before being granted access. Background verification includes identity verification, employment history verification, and criminal record checks as appropriate for the role.

9.2 Security Awareness Training

Every ERP Group employee receives mandatory security awareness training upon joining and annually thereafter — covering information security policies, data handling procedures, phishing awareness, password security, social engineering threats, and incident reporting procedures. Role-specific additional training is provided for employees in security-sensitive roles.

9.3 Principle of Least Privilege for Employees

ERP Group applies the principle of least privilege to all employee access — granting each employee access only to the systems, tools, and customer data necessary for their specific job responsibilities. Access privileges are reviewed quarterly and revoked immediately when an employee changes roles or leaves the organisation.

9.4 Confidentiality Obligations

All ERP Group employees and contractors sign comprehensive confidentiality agreements that legally bind them to protect the confidentiality of customer data, business information, and proprietary technical information — both during and after their employment or engagement with ERP Group.

10. Physical Security

10.1 Data Centre Physical Security

ERP Group's data is hosted in data centres with comprehensive physical security controls — including 24/7 manned security, biometric access controls restricting entry to authorised personnel only, CCTV surveillance of all areas, mantrap entry systems for sensitive areas, visitor access logs, and regular physical security audits by independent assessors.

10.2 Office Security

ERP Group's offices implement physical security controls appropriate to protecting sensitive business and customer information — including access-controlled entry systems, clean desk policies, secure document disposal, locked storage for physical documents, and screen privacy filters on workstations in common areas.

10.3 Device Security

All ERP Group devices used to access production systems or customer data implement full-disk encryption, mandatory password/PIN protection, remote wipe capability in case of loss or theft, and mobile device management (MDM) software that enforces security policies and enables remote management.

11. Business Continuity & Disaster Recovery

11.1 Business Continuity Planning

ERP Group maintains a formal Business Continuity Plan — defining the procedures for maintaining essential business functions during and after significant disruptions including natural disasters, power failures, network outages, cyber incidents, and public health emergencies. The plan is reviewed and updated annually and tested through regular tabletop exercises.

11.2 High Availability Architecture

ERP Group's platform is built on a high-availability architecture — with redundancy at every layer including web servers, application servers, database servers, and network infrastructure. Automatic failover ensures that the failure of any single component does not result in platform unavailability.

11.3 Platform Uptime Commitment

ERP Group targets 99.9% monthly uptime for its platform — representing less than 45 minutes of unplanned downtime per month. Platform uptime is monitored continuously and reported on our status page. Scheduled maintenance windows are communicated in advance via email and in-platform notifications.

12. Customer Data Rights & Security Controls

12.1 Data Export & Portability

ERP Group provides all customers with the ability to export their complete business data — including financial records, GST data, customer and vendor information, and all other business data — in standard formats including CSV and Excel. Data exports can be requested at any time through the platform's data management settings.

12.2 Data Deletion

Upon closure of your ERP Group account, your data is retained for the periods required by applicable Indian law — including 8 years for GST and financial records as required under the GST Act and Income Tax Act. After the applicable retention period, your data is securely deleted using industry-standard data destruction methods that prevent recovery. You can request confirmation of data deletion after the applicable retention period by emailing [email protected].

12.3 Account Security Controls for Customers

ERP Group provides customers with the following self-service security controls within the platform — MFA setup and management for all account users, active session viewing and remote termination, trusted device management and revocation, user access and permission management, complete audit log access for all account activity, and security alert configuration for unusual login activity.

13. Third-Party Security Management

13.1 Vendor Security Assessment

ERP Group evaluates the security practices of all third-party service providers before integration — assessing their data protection policies, security certifications, incident response procedures, and compliance with applicable data protection laws. Only vendors that meet ERP Group's security standards are approved for use with customer data.

13.2 Data Processing Agreements

All third-party service providers that process customer data on ERP Group's behalf are bound by formal Data Processing Agreements — legally requiring them to process data only for the specified purpose, implement appropriate security measures, report security incidents affecting customer data promptly, and delete data when it is no longer needed.

13.3 GSTN Security Compliance

ERP Group's GSTN integration partners and API service providers are subject to the security requirements specified by the Goods and Services Tax Network — ensuring that all GST data handling by third-party components meets the government's security standards for authorised GST service providers.

14. Reporting Security Concerns

14.1 How to Report a Security Vulnerability

If you discover a potential security vulnerability in ERP Group's platform — including vulnerabilities in our website, mobile app, API, or any other component — please report it responsibly to our security team:

📧 Security Email: [email protected] 📝 Subject Line: Security Vulnerability Report — [Brief Description] ⏱️ Response Time: Within 48 hours of receipt

Please include in your report a description of the vulnerability, the steps required to reproduce it, the potential impact if exploited, and any proof-of-concept code or screenshots that help illustrate the issue. Please do not exploit the vulnerability beyond what is necessary to demonstrate its existence, and do not access, modify, or delete customer data during your investigation.

14.2 How to Report a Security Incident

If you suspect your ERP Group account has been compromised — through unauthorised access, unusual activity, or any other security concern — please contact our security team immediately:

📧 Email: [email protected] 📞 Phone: +91 93555 091010 ⏱️ Response: Immediate for confirmed incidents — 24/7

You should also immediately change your account password, revoke access for any suspicious active sessions through your account security settings, disable any user accounts you do not recognise, and enable MFA if not already active.

15. Contact Our Security Team

For any questions, concerns, or requests related to ERP Group's security practices — including requests for security documentation, compliance certifications, or security assessment questionnaires from enterprise customers — please contact our Security and Compliance team:

ERP Group — Security & Compliance Team

📧 Security Reports: [email protected] 📧 Compliance Queries: [email protected] 📧 Privacy Concerns: [email protected] 📧 Grievance Officer: [email protected] 📞 Phone: +91 93555 091010 🌐 Website: www.erpgroup.in/contact 🏢 Address: A-2, Rajouri Garden, New Delhi — 110027 ⏱️ Business Hours: Monday to Saturday, 10:00 AM — 6:00 PM IST