Security Best Practices

EGKits SaaS V10 provides enterprise-grade identity, authorization, and audit capabilities — but effective security depends on how each tenant configures policies, roles, and integrations. This guide defines recommended standards for administrators and security officers.

#Security principles

#Identity and authentication

#Multi-factor authentication (MFA)

• Require MFA for all administrative roles without exception.
• Require MFA for finance roles with posting, approval, or export permissions.
• Prefer authenticator apps (TOTP) over SMS where possible.
• Document MFA reset procedure requiring out-of-band identity verification.
• Review MFA enrollment status monthly from Administration > Users.

#Password and session policy

Configure under Administration > Security Policies:

#Single sign-on (SSO)

• Use SSO for enterprises with centralized identity (Azure AD, Okta, etc.).
• Maintain at least one break-glass local admin account stored in a secure vault.
• Map IdP groups to EGKits roles explicitly — avoid default super-admin mapping.
• Monitor IdP certificate expiry; renew 30 days before expiration.

#Role-based access control (RBAC)

#Role design standards

1. Start from seeded roles — customize rather than creating redundant roles.
2. Name roles by function — Finance Clerk, Sales Manager, not User Type 3.
3. Avoid permission sprawl — if a role needs >80% of module permissions, split duties.
4. Document role intent in your internal governance wiki with permission matrix.
5. Review quarterly — remove unused roles; audit membership.

#Segregation of duties matrix

Configure approval workflows so the same user cannot create and approve the same document class where policy requires separation.

#API keys and integrations

Disable unused API keys rather than leaving them dormant.

#Data protection and tenant isolation

• Confirm users access only their tenant URL — train staff to recognize phishing domains.
• For dedicated-database plans, restrict database credentials to infrastructure team.
• Export sensitive reports only through authenticated sessions — avoid emailing unencrypted attachments.
• Apply branch scoping so regional staff cannot view other regions unless required.
• Use Document Archive retention policies aligned with legal hold requirements.

#Audit and monitoring

1. Enable Audit Trail review cadence — weekly for admins, monthly for standard tenants.
2. Alert on: bulk exports, role changes, API key creation, failed login spikes.
3. Retain audit logs per your compliance framework (SOX, GDPR, local tax law).
4. Correlate EGKits audit entries with IdP sign-in logs for SSO tenants.
5. Include security review in onboarding and offboarding checklists.

#Offboarding checklist

#Compliance alignment

EGKits provides controls that support common frameworks — implementation responsibility remains with the customer:

Consult legal and compliance teams for jurisdiction-specific requirements (e-invoice, payroll, PII).

#Incident response

1. Contain — disable compromised accounts and API keys immediately.
2. Assess — review Audit Trail for unauthorized transactions or exports.
3. Notify — follow internal IR plan; contact EGKits support for platform issues.
4. Remediate — reset credentials, patch integration, tighten policies.
5. Document — post-incident review with timeline and preventive actions.

#Related links

• Identity & Access Guide — detailed RBAC configuration
• Multitenancy Guide — isolation topologies
• Login Issues — authentication diagnostics
• Audit Trail Guide — investigation workflows
• System Configuration Guide — security settings