Security is architecture, not a feature.
Empowa360 is designed so that your business data stays yours, and the commercial platform stays honest.
Data ownership
Your business data lives inside your own Empowa360 installation, on your hosting. The central Empowa360 platform stores only commercial information: subscription, billing, license and installation metadata.
Standalone installations
Empowa360 is licensed per installation. One client, one installation, one database. The central platform does not become a shared database of your operations.
Authentication
Passwords are hashed using modern algorithms. Sessions are hardened (HttpOnly, SameSite, Secure when served over HTTPS). Login attempts are rate‑limited and lockout applies.
Encryption where applicable
Sensitive communication between your installation and the central platform is authenticated and signed. Transport is protected by TLS in production.
Payment security
Card and recurring payments are processed by PayPal using their official subscription APIs. Empowa360 never stores your raw card data. Webhooks are verified before any state change.
Backups
You control backups of your own installation and database. We recommend scheduled backups and off‑site copies as part of your hosting setup.
Licensing
Licenses are issued and managed centrally. Validation is server‑side and signed, so local tampering cannot silently extend a subscription.
Access control
Administrator access uses role‑based access control (RBAC). Every sensitive action is logged.
Secure development
Prepared statements, CSRF protection, XSS protection and server‑side validation are used throughout. Secrets are configured outside source control.