Built for a system that holds your commercial terms and your payroll
Everything below already exists in the software. None of it is an add-on, a paid tier, or something that arrives in a later version.
Getting in
Three independent gates, each one optional, each one enforced on the server rather than in the browser.
Two-factor authentication
Standard time-based one-time passwords, enrolled by scanning a QR code into any authenticator app. The challenge expires after five minutes and locks after five failed attempts.
Trusted devices
A user can mark their own machine as trusted and skip the second factor on it, without weakening the requirement anywhere else.
Administrator-approved devices
Switched on per user, a new browser must be approved by an administrator before that person can sign in from it at all. Approvals can be revoked later.
Login alerts
Sign-ins raise an email to a nominated mailbox, so an unexpected session is noticed the same day rather than at the next audit.
Sessions that expire
Thirty minutes idle and the session ends, enforced at both ends, with a keep-alive heartbeat so active work is never interrupted mid-form.
Who can do what
Not three tiers of user. Five independent rights on each module, for each role, plus the tabs inside it.
Five rights per module
Show in menu, view, add, edit and delete are set separately. A role can be allowed to create purchase orders and never to delete one.
Tabs hide individually
Within a module a role can see, specific tabs are hideable — so an HR role reaches employees and attendance but not advances and loans.
Unlimited custom roles
Nine roles ship ready to use. Create your own with its own name, tag and colour; only the super administrator role is locked.
Checked twice, trusted once
The interface hides what a role cannot use, and every request is independently authorised on the server before it runs.
A named editing authority
One nominated role may edit an already-approved quotation, invoice or purchase order. Everyone else raises an edit request instead.
What happened to the data
Changes are recorded, deletions are reversible, and secrets are not sitting in the database in the clear.
Audit log with before and after
Actions are written with the user, the module, the record, the old values and the new values, and the originating IP address.
Every session logged
Login and logout with IP, browser, duration, and whether the session ended manually, timed out, or was forced.
Soft delete and restore
Deleting hides a record and stamps who did it. An administrator can restore it intact or purge it permanently.
Secrets encrypted at rest
Mailbox passwords, Google credentials and authenticator seeds are stored encrypted, not as readable text.
Uploads that are what they claim
Attachments are size-capped and checked by inspecting the file itself, not by trusting its extension.
Where it runs
One company, one database. There is no shared tenancy — your records are not co-located with anyone else’s.
Single tenant by design
Each deployment is one company on its own database. The system has no concept of another tenant.
Managed by Big Beam
Big Beam hosts and operates the deployment and, where needed, provisions your business mailboxes — see implementation and hosting.
Hardened in the browser too
A strict content security policy, framing and MIME-sniffing protections, and a restrictive permissions policy ship with the application.
Parameterised throughout
Database access uses prepared statements with emulation off, across the whole application — not selectively where someone remembered.
See it running on your own documents
Tell us what your company does and which modules you would actually use. We will walk you through the system handling your work — not a slide deck.