Loading
Loading
Security and governance
Z-SYSTEM sits between your people and SAP Business One. Every request is authenticated, checked against permissions and recorded before it goes anywhere. This page sets out the controls we run, how connection credentials are handled, and which parts stay with your organisation.
Control layers
Security is not a feature list. It is six areas that have to hold together, from the person signing in at the start of a shift to the day a system has to come back up.
Every request starts with the same two questions: who is this person, and what are they allowed to do.
The common web application weaknesses are handled in the code, not patched over afterwards.
Data is encrypted in transit and at rest, and revealed only as far as the task in front of the user requires.
Z-SYSTEM connects only through SAP’s standard integration surface, and never writes to the database directly.
Anything that matters leaves a trace, so an auditor’s question can be answered from the record rather than from memory.
Security does not end on go-live day. It lives in how the system is looked after afterwards.
Connection credentials
The first question most IT teams ask is how the SAP Business One password is held. These are the rules we work to, and no screen is an exception to them.
SAP Business One user names, passwords and connection settings are held and used on the server. Nothing is embedded in browser code or in any file a user can download.
Where credentials must be persisted, they are encrypted before they reach the database and decrypted only at the moment a connection is opened.
If you already run a secret manager, Z-SYSTEM can read connection secrets from it at runtime instead of holding them in the application database.
No Z-SYSTEM API returns a credential value to the browser, not even for an administrator. The settings screen shows connection status and a masked value.
Sensitive values are stripped from log lines and error messages before anything is written. Whoever reads the log sees whether a connection succeeded, not what it used.
Credentials can be rotated whenever your policy requires it. An administrator saves the new value and confirms the connection in the same step.
The test reports the result and a high-level error code only. It does not expose host names, database names or internal detail that could be reused elsewhere.
Connection settings and connection tests are limited to administrator roles, and every change is written to the audit trail. Results depend on your processes, existing systems and the scope of each deployment.
Shared responsibility
Security only works when the line is drawn early. This is the split we work to from the first project meeting.
| Area | Z-SYSTEM provides | Your organisation owns |
|---|---|---|
| Identity provider | Standards-based SSO connectivity, plus role and permission management inside Z-SYSTEM. | Password policy, multi-factor rules, and the joiner, mover and leaver process for accounts. |
| Network access | HTTPS enforcement, outbound allow-listing and support for private network connectivity. | Firewall, VPN and IP allow-list configuration around your SAP Business One landscape. |
| SAP licensing | An integration built on SAP’s standard interfaces, and flexible user administration within Z-SYSTEM. | Licence compliance is your responsibility. Your use of SAP Business One and any integration remains subject to your organisation’s licence agreement. |
| Device security | Session lifetime, automatic sign-out and a list of the devices that signed in most recently. | Endpoint management for laptops and phones, disk encryption and operating system updates. |
| Data classification | Screen-level and record-level permissions, field masking and controls on data export. | Deciding which data is confidential, who should see it, and the internal disclosure policy. |
| Backup policy | Backups of Z-SYSTEM data on an agreed schedule, with periodic restore testing. | Backup and restore of the SAP Business One database, and the recovery time and recovery point objectives you set. |
| Penetration testing | Internal application security testing on a regular cycle, with findings remediated by severity. | Commissioning any third-party test, and agreeing scope and timing with us in advance. |
| Incident response | Detection, alerting and remediation for platform incidents, followed by a written post-incident summary. | Your internal owners, your escalation path, and any regulatory notification the law requires of you. |
Z-SYSTEM is built to security best practice, with additional controls configurable to your organisation’s policy. We do not claim any security certification. Our controls and audit evidence are designed to support your own compliance programme. The level of protection you achieve depends on your configuration, your environment and the policies you enforce. Results depend on your processes, existing systems and the scope of each deployment.