Everyday security: two-step verification, team isolation and an audit trail

A platform that holds a company's cash, customers and contracts has to treat security as routine, not as a project. Below is what already applies to every Valerium account, from Starter to Ultimate.

Signing in

Sign-in works with a code sent to your e-mail or with your Google or Microsoft account — no password to leak. In Settings › Security you turn on two-step verification with an authenticator app and get backup codes in case you lose your phone. Sessions left idle for too long are closed on their own.

Each team in its own space

Every record belongs to exactly one team. That rule is enforced in the database and, again, on the server for every request — hiding a button in the interface is never the only barrier. Inside the team, roles (owner, admin, member, viewer) and custom roles decide who can see and who can edit each module.

What gets recorded

Sensitive actions — invites, role changes, API keys, customer-portal sends, financial changes — go to an audit trail with who did it, when and from where. Integration credentials are stored encrypted and never reach the browser.

• —Sign-in by e-mail code, Google or Microsoft; two-step verification with an authenticator app and backup codes
• —Team isolation enforced in the database and on the server
• —Roles and custom roles per module (no access, view or edit)
• —Audit trail of sensitive actions and automatic sign-out of idle sessions
• —Password-less customer portal: 6-digit e-mail code, valid for 10 minutes
• —Optional cookies only with your consent

The rule we follow: the browser is never trusted. Every validation, permission and limit exists on the server first.

Found something that looks wrong? Write to support@grovicdata.com. Security reports take priority over any other ticket.