Security at Elqar

Every customer organisation's data is isolated at the database layer, not only by convention in individual application code. Access to another organisation's data fails closed by default rather than falling back to an unfiltered result.

This is covered by an automated test suite that includes direct cross-organisation attack simulations - attempting to read, update, and delete another organisation's records and confirming each attempt is correctly rejected. The same isolation was also independently verified through live testing.

We run independent automated security scans against the live production site covering common web vulnerability classes. The most recent scan returned zero Critical or High findings; applicable Medium/Low findings were reviewed and fixed. Any exception is only left open where a fix would break a required third-party integration against a threat class that does not apply to this application, and only after that reasoning is documented internally.

We also run recurring internal, code-level security reviews covering the full application surface - authentication, authorisation, injection, and data-handling paths - and fix findings before they reach production.

• Passwords are hashed with an industry-standard algorithm - never stored or logged in plaintext
• Sessions use short-lived, signed tokens
• Email verification required on signup via a one-time code
• Password reset uses single-use, time-limited tokens
• Rate limiting on authentication and other sensitive endpoints

• All data in transit is encrypted (HTTPS/TLS)
• Hosted on established, reputable cloud infrastructure providers - see our Data Processing Agreement for the full sub-processor list
• Encrypted database backups, verified end-to-end via a real restore test - not just "the job ran"
• Audit logging of data access and modifications
• Signature verification and replay protection on all payment provider callbacks

See our Privacy Policy, Data Processing Agreement, and Terms of Service for how customer and personal data is handled, retained, and deleted.

If you believe you've found a security issue in Elqar, please email us at hello@elqar.com with details. We ask that you avoid accessing or modifying data that isn't yours while investigating, and give us a reasonable window to respond before any public disclosure.