Monalisa ERP

Security & governance

Public-company controls, no side spreadsheets

Per-customer isolation, fine-grained permissions, segregation of duties and an audit trail that exposes any tampering.

  • Isolated multi-tenancy

    Each customer's data is kept separate in every table and query.

    • Every query filtered by customer
    • Files in private object storage
    • Rate limits and security headers

  • Granular permissions

    Permissions per action, per company and per store, with role templates.

    • Scope by company and by store
    • Two-factor authentication (TOTP)
    • Periodic access reviews

  • SoD & approval limits

    The Approvals Center prevents the same person from requesting and approving.

    • Second person required where it matters
    • Limits that fail closed
    • Approval voided if the content changes

  • Audited assisted access

    Support only gets in with a recorded reason, a short time limit and read-only by default.

    • Who acted and on whose behalf
    • Time-bound session
    • Everything in the trail

Audit trail

Every record carries the hash of the one before

The trail is written in the same transaction as the change — either both persist or neither does. It is append-only, and a separate process seals records into a per-customer hash chain. Altering a row breaks the chain, and verification shows where.

  • Written in the same transaction as the effect
  • Append-only, sealed in a SHA-256 chain
  • Personal data and secrets never in plain text

Ready for a public-company audit

Controls designed for external audits and capital-market requirements, with evidence generated by the system itself.

  • Control suite with automated tests and periodic verification
  • Per-object dossier: who requested, who approved, what changed
  • Immutable, hashed closing package
  • Mandatory idempotency on financial commands
  • Reconciliations with an independent reviewer

LGPD end to end

Consent is data, not a forgotten checkbox: it has a purpose, evidence and an effect on integrations.

  • Purpose-based consent with evidence
  • Personal data report for the data subject
  • Revocation propagated to CRM and Marketing with receipt
  • Central suppression that blocks sends

See Monalisa working in your reality

Book a demo with our team. No commitment, no long form.

Book a demoExplore the product