Security

How ASTRO CSM protects your data

Customer contracts and invoices deserve more than a promise. This is what the product does today.

Your company's data is separate

• Every business record belongs to one company, and SQL Server row-level security enforces that in the database itself, behind the application's own checks.
• Membership of a company is checked on every request. A record from another company answers "not found".
• Files are stored under a separate location for each company.

Signing in

• Everyone signs in with an e-mail address, a password and a six-digit code from an authenticator app. No company can switch the code off.
• A person is signed out after 30 minutes without activity.
• "Sign out everywhere" ends every session at once when a phone is lost or someone leaves.

Who can see and do what

• Every action in the product is protected by a named permission, and administrators decide which role holds which permission.
• Access can also be limited to particular brands.
• A role change takes effect on the person's next click.

Keeping a record

• Changes to records keep a history of who changed what and when.
• Deleted records go to a recycle bin an administrator can restore from.
• Issued invoices keep their numbers and are corrected with credit notes or voiding, never rewritten.

Infrastructure

• ASTRO CSM runs on Amazon Web Services, and connections use HTTPS.
• Uploaded files are scanned for malware.
• Each company's own e-mail provider credentials are held in a dedicated secrets store, never in the database and never shown again after you save them.

The assistant

• The assistant reaches your data through the same permission checks as the screens, using the signed-in person's own access.
• The AI model runs through Amazon Bedrock.
• Changes it proposes wait for a person to confirm them.

Questions

Need more detail for a security review? E-mail sales@astrocsm.com.