Trust

How your production data is protected.

Your BOMs, costing and customer list are among the most commercially sensitive things your business owns. Here is how the system treats them — described plainly, without security theatre.

Access control

Token-based authentication with short-lived access tokens and separately managed refresh tokens.
Role-based permissions, so a storekeeper sees stock screens and not your margin analysis.
Custom roles beyond the built-in administrator levels, defined per deployment.
Password reset by verified email flow rather than by asking support.

Data in transit and at rest

All traffic over HTTPS with TLS; plain HTTP is redirected, not accepted.
Passwords stored as salted hashes, never in a recoverable form.
Uploaded documents and drawings held in object storage with access mediated by the application.
Database access restricted to the application; no direct public exposure.

Backups and continuity

Automated backups on managed cloud deployments, with retention agreed at onboarding.
Schema changes applied through versioned, ordered migrations rather than manual edits.
On-premise deployments: backup schedule and retention are yours to define, and we help you set them up correctly.

Where your data lives

Managed cloud hosting on infrastructure located in India.
On-premise deployment on your own server, on the Enterprise plan — data never leaves your premises.
Each customer's data is separated at the database level rather than mixed in shared tables.
Full export on request, at any time, including on exit.

Audit trail

Manufacturing data is only trustworthy if you can see how it changed. Inventory movements are recorded as an immutable log — corrections are reversing entries, not edits — so the question "who moved this stock, and when" always has an answer.

The same applies to engineering changes. A BOM revision carries a change number, a reason and an approver, which means a design change is a traceable event rather than something that simply appeared.

What we do not claim

We are a small company, and it is worth being direct about the limits of that. We do not currently hold ISO 27001, SOC 2 or comparable third-party certification. If your procurement process requires one, that is a legitimate requirement and we would rather tell you now than partway through a security questionnaire.

What we can offer instead is specificity: we will answer detailed technical questions honestly, walk your IT team through the architecture, and support an on-premise deployment if that is what your risk posture calls for.

Reporting a vulnerability

If you believe you have found a security issue in NextGenManager or on this website, please email support@ngmerp.in with the subject line "Security". Include enough detail to reproduce it.

We will acknowledge within two working days and keep you updated until it is resolved. We will not pursue action against anyone who reports an issue in good faith, does not access or modify data belonging to others, and gives us a reasonable window to fix it before disclosure.