NIST SP 800-171 · CMMC Level 2
For US defense suppliers handling Controlled Unclassified Information. All 110 requirements are mapped to what the ERP provides and what is yours, with a hardened mode, a restricted data mode and CUI marking.
SECURITY & STANDARDS
Your data, protected.
Our work, open to inspection.
Security equipment businesses answer to demanding customers, auditors and governments. Xeytek ERP is built so that you can show them how your data is kept safe, and we show you how we work.
- Your own installation and database
- Phishing-resistant sign-in
- Encrypted where it matters
- Every change recorded
01 / STANDARDS
Measured against
recognised standards.
Each one says plainly where we stand: what is built into the product, and what supports your own assessment.
FIPS 140-3
With FIPS mode on, the server's encryption runs only through a FIPS 140-3 validated module that comes with the ERP: the OpenSSL 3.1.2 FIPS provider.
NIST SP 800-63B
Password rules as NIST recommends: a minimum length you choose, common and easily guessed passwords refused, no forced symbols or periodic changes. Passwords are stored only as hashes.
Passkeys · two-step sign-in
Sign in with a fingerprint, face or PIN (Windows Hello, Face ID, security keys). A passkey only works at your ERP's own address, so it can't be phished. Authenticator apps (TOTP) with recovery codes too.
SAML 2.0 · OpenID Connect
Company sign-in with Microsoft 365 (Entra ID), Google Workspace, Okta, ADFS, OneLogin, PingFederate or any other provider. When someone's company account is closed, so is their way in.
AES-256-GCM
Sensitive HR details (ID and passport numbers, bank details, salary, personal contacts) are encrypted in the database. Off-site backups are encrypted before they leave your server, with a recovery key only you hold.
HTTPS · HSTS · CSP
HTTPS everywhere, with automatic certificates or your own, and Strict-Transport-Security once it's on. A strict Content-Security-Policy allows scripts only from your own server, and framing by other sites is refused.
PDPA · LGPD · KVKK
Tools for privacy requests under Malaysia's, Brazil's and Turkey's data protection laws, and similar rights elsewhere: find a person, export or anonymize their details, with each deadline tracked.
Straight answers for your auditor.
CMMC assesses a company's own environment, so no software is "CMMC certified": the ERP is one of the assets in your assessment, and we give you what your assessor asks for. Set up as described in our pack, none of your controlled information reaches us, so we are not an External Service Provider in your assessment, and we sign a statement saying so.
02 / IN THE PRODUCT
Security in every layer,
not bolted on.
Only the right people get in
Passkeys, two-step sign-in required for admins or everyone, and company sign-in. After 5 failed attempts an account locks for 15 minutes, and password spraying from one address is stopped. A sign-in from a new device sends an alert.
Permissions by role
Over 50 areas, each switched on per role, from CRM and production to HR and each Settings tab. Deal values and prices are a separate area, so production and service staff can work on an order without seeing what it's worth.
Sessions you control
A secure cookie scripts can't read, sign-out after inactivity, a screen lock, and access only from your own networks if you choose. Everyone sees where they are signed in; admins can sign anyone out everywhere.
Encrypted where it matters
HTTPS everywhere, a strict Content-Security-Policy, field-level encryption of sensitive HR data and masked fields for those who may not see them. Uploaded files are served only to people allowed to see their record, and can be scanned for malware.
Everything recorded
An audit trail of who changed what and when, sign-ins, failed attempts and every view of sensitive HR records. A change whose record can't be written is refused. A built-in Security check shows admins what to fix, and where.
Signed updates
Every release is signed by us and checked before it's installed, with a backup first and a rollback if it fails. An installation check confirms that the files on your server are exactly as released.
03 / YOUR DATA STAYS YOURS
What we can see:
as little as possible.
Your business runs on your records. We designed the ERP so that they stay with you.
Your own installation
In our managed cloud or on your own server, you get your own installation and database, never shared with another customer. On your server, we have no account in it and no remote access.
A daily check-in, no business data
Once a day the ERP checks its license with us, sending only identifiers, its version, the number of active users and whether its files are as released. No customer, order, ticket or HR data. The answer is signed, and the check-in can be turned off.
AI that doesn't keep your data
Xeytek AI requests pass through our gateway to Anthropic's Claude; we don't store what was asked or answered, and the data isn't used to train models. Only what a feature needs is sent, and each feature can be switched off.
Backups only you can open
Daily backups on your server, and off-site copies encrypted before they leave it, in our storage, your own S3-compatible storage, or both. We cannot open them: only your recovery key can.
One switch for restricted data
Restricted data mode stops everything that would carry your data to us or the services behind ours: AI features, dictation, driving times and flight prices for service trips, and off-site copies in our storage. Your own off-site storage keeps working.
One switch for strict settings
Hardened mode puts every security setting at its strict value, after showing each change. While it's on, settings can be made stricter but never looser.
04 / HOW WE BUILD IT
Checked on every change,
before it reaches you.
Security isn't a release milestone. It's part of how every change is made, tested and shipped.
About 1,400 automated checks
Run against a fresh database on every change: permissions, sign-in rules, encryption, privacy exports and the business workflows.
Secrets and vulnerabilities scanned
Every change is scanned for leaked passwords, keys and tokens, and every third-party package is checked against published advisories on every change and every week.
Risky code refused
Automatic rules reject patterns such as running text as code, building shell commands from input, and expressions crafted input could slow down.
Signing keys that stay with us
Release-signing keys never leave our own devices. A list of every software package in the product, with its version and licence, is available under NDA.
Independent testing
An external penetration test is being arranged. A summary of the findings and their fixes will be available to customers under NDA.
05 / SHARED RESPONSIBILITY
Your part
and ours.
Clear lines make audits simpler. The built-in Security check shows how your installation measures up.
- Build, test and sign every release, and fix security issues promptly
- Run the license server, the AI gateway and the backup storage
- For managed cloud: run and patch the server, HTTPS and daily backups
- Decide who has access and keep the user list current
- Require two-step sign-in, or use company sign-in
- Keep the backup recovery key safe outside the ERP
- On your own server: keep the operating system patched, a firewall in front, HTTPS on, and install updates
06 / FOR YOUR SECURITY TEAM
The documents
your review needs.
Ask for any of them through the contact form. They describe our controls in detail, so we share them under a non-disclosure agreement.
Security overview
Sign-in, permissions, encryption, backups, privacy, AI and how the software is built and checked, written for IT and security teams.
CMMC pack
A setup guide for CUI, every data flow out of the server, all 110 NIST SP 800-171 requirements with what the ERP provides, and our signed statement.
Security policies
Our information security policies, how we assess and treat risks, and the controls we apply, for your supplier review.
Software package list
Every third-party package in the product, with its version and licence.
07 / REPORTING A PROBLEM
Found a vulnerability?
Tell us.
Email security@xeytek.com with what you found and how to reproduce it. We confirm receipt within two working days and keep you informed until it's fixed. Please don't test against another customer's installation, and don't share the details publicly until a fix is released.
Security fixes go into the latest release, and installations get them through Settings → About & updates.
SEE IT FOR YOURSELF
Explore the platform.
Check the controls.
Your own private copy, with every module and every security setting,
free for 3 days.