The controls, described precisely
This page lists what the product actually enforces, not a certification badge. CALACC does not currently hold SOC 2 or ISO 27001 certification, and we would rather say so than imply otherwise.
Getting in, and proving who did what
Hashed credentials
Passwords are stored as salted hashes, never in recoverable form. Sessions are invalidated on password change.
Two-factor sign-in
TOTP authenticator support, with single-use backup codes for recovery if the device is lost.
Roles and permissions
A role sets the baseline; capabilities such as payroll officer or HR manager are granted per user on top of it.
Audit log
Actions are recorded with the user and timestamp, so a change to a record can be traced to a person.
Approval before posting
Invoices, bills and claims can require an approval chain, with escalation when a step is overdue.
Company isolation
Records are scoped to a company, and every query is filtered by it. A user in one company cannot read another's books.
Hardening at the request layer
Transport
Traffic is served over TLS. Cookies are marked Secure, HttpOnly
and SameSite=Lax, and HSTS is sent so the browser refuses a plain-HTTP
downgrade. Reverse-proxy headers are validated so the client address and scheme
the application sees are the real ones.
Request protection
CSRF tokens on state-changing forms, a strict Content-Security-Policy,
X-Frame-Options: DENY against clickjacking, nosniff, and
rate limiting on authentication endpoints so repeated attempts are throttled.
Secrets at rest
Values that must be recoverable — for example stored certificates — are encrypted with a key held outside the database, not stored in clear text.
Backups
The database is dumped and compressed to object storage on a schedule, with the retention period configured for the deployment. Restores are a documented, scriptable step rather than a manual procedure.
Personal data and retention
Accounting records contain personal data — employee identity numbers, salaries, bank details, and customer contacts. CALACC is built for Malaysian businesses and operates on the basis of the Personal Data Protection Act 2010: data is collected for the accounting purpose it serves, access is limited to users the company authorises, and records are kept for the statutory retention period.
Where a record must be retained for tax or company law, deletion requests are handled through a review flow rather than an immediate purge, so statutory obligations are not broken by a support request. See the privacy policy for the detail.
If you believe you have found a vulnerability, please report it privately through the contact page rather than disclosing it publicly.
Questions about a control?
We will answer specifically, including where a control does not exist yet.