Security

Your jobs, prices and customers, visible only to the right people.

A solar company holds customer details, margins, bank and subsidy information. HelioLattice limits who can see and change each of them, protects sign-in, and records what people do, so the business stays in your control.

Book a demo See the controls

How does HelioLattice protect data? Through role-based permissions and data scopes, hashed passwords, optional email one-time-code sign-in, account lockout after repeated failures, rate limits, sessions that expire within 24 hours, separate partner sign-in and an audit log.

Layers of protection

From sign-in to the record.

Sign in

Password sign-in, email one-time codes, or both, depending on how your business wants to work.

Password→Email code→Lockout

Session

Sessions expire within 24 hours and sign-in cookies are held out of reach of page scripts.

24h limit→Secure cookie→Sign out

Permissions

Roles decide which actions and reports a person can use, and data scopes decide which records.

Role→Scope→Record

Record

Sensitive actions are written to an audit log that administrators can review.

Action→Audit log→Review

The controls

What is in place.

Sign-in protection

Passwords are stored hashed, and an account locks for a period after repeated failed attempts.

  • Hashed passwords
  • Lockout after five failures

Email one-time codes

Sign in with a one-time code sent by email, with codes limited by rate controls.

  • Password, code or both
  • Rate-limited attempts

Session limits

Sessions end within 24 hours, and sign-in cookies are marked secure and HTTP only in production.

  • 24-hour maximum
  • Cookies not readable by scripts

Roles and scopes

Permissions across 26 areas, custom roles and data scopes for all, assigned or managed records.

  • 269 permissions
  • Hidden internal costing

Partner separation

Channel partners sign in to a separate portal and see only their own leads.

  • Separate sign-in
  • Own leads only

Audit log

Administrators can review what users did and when.

  • Who and when
  • Reviewable by admins

Keep exploring

Connected pages.

Access control →

Roles and permissions in detail.

Owner view →

What an owner can see and steer.

Privacy policy →

How we handle website data.

Questions

Common questions.

Can we limit who sees margins?
Yes. Internal costing on quotations is visible only to roles with that permission.
Can staff sign in with a one-time code?
Yes. Sign-in can use a password, an email one-time code, or both.
What happens after repeated wrong passwords?
The account locks for a period, and an administrator can unlock it.
Do partners see our internal data?
No. Partners use a separate portal that shows only the leads they submitted.
Where do I report a security concern?
Write to support@heliolattice.com.

Ask about your own security needs.

Bring your questions on roles, access and data to the demo.

Book a demo Access control