🔐 Security & Multi-Tenant

Security-First Architecture

VelvetCore is built with security at its core. Multiple layers of protection ensure your data stays safe and your business stays compliant.

Role-Based Access Control (RBAC)

A granular permission system covering every feature area — staff, scheduling, financial, client data, content, and system administration. Create custom roles tailored to your organisation with exactly the access each person needs.

Multi-Level User Permissions

Eight default roles out of the box: Super Admin, Administrator, Manager, Staff, Receptionist, Accountant, Compliance Officer, and Content Manager. Create unlimited custom roles for specialised access needs.

CSRF Protection

Cross-Site Request Forgery protection on all state-changing operations. Token-based validation prevents unauthorised actions. Automatic token rotation and expiration.

XSS Prevention

Output encoding prevents Cross-Site Scripting attacks. All user-generated content is sanitised before display. Content Security Policy headers add an additional layer of protection.

SQL Injection Prevention

Prepared statements with parameter binding prevent SQL injection attacks. Query builder enforces safe database access patterns. No raw SQL from user input.

Data Encryption

AES-256 encryption for sensitive data at rest. SSL/TLS encryption for data in transit. Bcrypt password hashing with automatic salt generation. Encrypted storage for documents and personal information.

Complete Tenant Isolation

Multi-tenant architecture with complete data separation. Each tenant operates in an isolated database schema — no cross-tenant data access is possible. Designed for both SaaS and self-hosted deployments.

Custom Domain Support

Full custom domain support for branded experiences. Subdomain provisioning for multi-location businesses. Automatic SSL certificate management. Domain verification ensures security.

Session Security

Secure session management with httpOnly and secure flags. Automatic session timeout after inactivity. Session fixation protection and regeneration on privilege changes.

Audit Logging

Complete audit trail of all security-relevant events. Track login attempts, permission changes, and data access. Automated alerts for suspicious activity.