Security · Permissions · Audit

Data safety – Reliable operations

ERPCons is built with multiple layers of security, flexible permissions and comprehensive audit tools, helping businesses control risk, meet standards and comply with regulations.

Permissions by role and project
Encryption of stored and transmitted data
Access logs and audit log
2FA/SSO authentication

Learn about security Free trial

Tenant isolation

Audit log

Data encryption

Comprehensive security – Transparent control

Four pillars protecting business data on ERPCons.

Multi-level permissions

By role, project, department, down to individual data fields.

Activity log (Audit)

Records who did what, when and on which device.

Encrypted data security

Encrypted in transit and at rest, with a separate key per tenant.

Standards & regulatory compliance

Aligned with ISO/IEC 27001 and Decree 13/2023/NĐ-CP.

Absolute safety – Transparent operations – Lasting trust

The right people – the right tasks

Set up once, applied consistently across Web, Mobile, API and PI Agent.

Permissions by role, project, department and branch
Limits by approval threshold and sensitive data fields
One person can hold multiple roles, no extra accounts needed
Time-limited delegation for business trips and leave
Partners and subcontractors only see their own work packages

Multi-role staff, complex permissions

Sample permission matrix – Building A Project

Allowed No… Limited

Role	View project	Edit quantities	Approve payments	View finance
Director		Approve
Chief Accountant
Site manager	Assigned projects		≤ 200M	Project
Site engineer	Assigned projects
Procurement				Procurement
Subcontractors	Work package	Recommend

Strong authentication – Data isolation – Full audit

2FA & SSO

Two-factor authentication via OTP app, SMS or email; single sign-on (SSO) with PI Holding, Google Workspace and Microsoft 365 accounts.

2FA enforced by role
Password policy & temporary lockout
Remote session revocation

Tenant isolation

Each business has its own data space: database, encryption keys and backups are kept separate.

No cross-access between businesses
Separate encryption key per tenant
Dedicated deployment option (On-premise)

Audit log – Activity log

Tamper-proof

Time	Performed by	Action	Status
09:42:18	Trần Minh	Approved payment batch 3 – Contract 045	Success
09:30:05	Lê Hoa	Edited steel unit price (14,200 → 14,650)	Changed
08:57:41	PI Agent	Created draft purchasing task	Pending approval
08:12:09	Unknown	Wrong password entered 5 times	Locked

Stores before/after values, IP address and device. Export audit reports by period, user or project.

Updated 01/10/2026

Privacy policy

Summary of the main terms on collecting, using and protecting data on ERPCons.

ISO/IEC 27001 (aligned)Decree 13/2023/NĐ-CP2018 Cybersecurity LawOWASP Top 10TLS 1.2+AES-256 encryption

The full Privacy Policy and Data Processing Agreement (DPA) are provided with the service contract.

Contact the security team Terms of use

This policy applies to the ERPCons.ai website, the ERPCons app on Web, iOS and Android, and connected services in the PI Holding ecosystem.

Account information (full name, email, phone number, organization), business data entered into the system by the company, and technical access logs (time, device, IP address).

To provide and operate the service, support customers, ensure system security and send necessary notifications. We do not sell data to third parties.

Data is encrypted in transit (TLS) and at rest, isolated per business (tenant), backed up regularly and access-controlled on the principle of least privilege.

Shared only at the business's request (for example API integration), with infrastructure providers under confidentiality contracts, or at the request of competent state authorities.

Users have the right to be informed, access, correct and export data, withdraw consent and request deletion under current personal data protection regulations.

Data is kept for the duration of service use and the term set in the contract; upon termination, the business can export its data before secure deletion.

For any questions about security and personal data, please send them via the Contact & consultation page – the security team will respond within 2 business days.