Data isolation
Customer organisation data is isolated at the database layer. Elqar's published security tests include direct cross-organisation read, update, and delete attempts.
Your data deserves
a clear answer.
Understand the controls Elqar describes, what has been tested, and where to ask questions.
Published page last updated 9 August 2026
Authentication & access
Passwords are hashed; sessions use signed, short-lived tokens. Signup verification, single-use reset tokens, and rate limits protect sensitive paths.
Security testing
Elqar reports independent automated scans of the live site and recurring internal code reviews covering authentication, authorisation, injection, and data handling.
Infrastructure
Traffic uses HTTPS/TLS. The published controls also describe encrypted database backups that are verified through a restore test.
Auditability
The application records stock changes and describes audit logging for data access and modifications. Payment callbacks are checked for valid signatures and replay.
Data handling
The Privacy Policy and Data Processing Agreement set out retention, subprocessors, and processing terms in more detail.
These are Elqar’s published controls, not a certification or guarantee. The detailed descriptions follow below.
The published detail
What sits behind the summary.
Concrete controls and testing as described on this page. Contact the team for questions about your own requirements.
01 / Multi-tenant data isolation
Every customer organisation’s data is isolated at the database layer, not only by convention in individual application code. Access to another organisation’s data fails closed by default rather than falling back to an unfiltered result.
An automated test suite includes direct cross-organisation attempts to read, update, and delete another organisation’s records and checks that each attempt is rejected. The same isolation was independently verified through live testing.
02 / External security testing
Elqar runs independent automated security scans against the live production site covering common web vulnerability classes. The most recent scan reported zero Critical or High findings; applicable Medium and Low findings were reviewed and fixed. An exception is left open only when a fix would break a required third-party integration against a threat class that does not apply to this application, with the reasoning documented internally.
Recurring internal code reviews cover authentication, authorisation, injection, and data-handling paths, with findings addressed before production.
03 / Authentication and access
- Passwords are hashed with an industry-standard algorithm and are never stored or logged in plaintext.
- Sessions use short-lived, signed tokens.
- Signup requires email verification via a one-time code.
- Password reset uses single-use, time-limited tokens.
- Authentication and other sensitive endpoints have rate limits.
04 / Infrastructure and data protection
- Data in transit is encrypted using HTTPS/TLS.
- Elqar uses established cloud infrastructure providers; the Data Processing Agreement lists subprocessors.
- Encrypted database backups are verified through a real restore test.
- Audit logging covers data access and modifications.
- Payment provider callbacks use signature verification and replay protection.
Policies and processing
Review the detail.
Make policies easy to find, without burying them inside marketing copy.
Responsible disclosure
Found a possible vulnerability?
Email details to our team. Avoid accessing or changing data that is not yours while investigating, and give us a reasonable window to respond before public disclosure.
Report to hello@elqar.com