Security & resources
Isolation and control, by design
CRGNexus is multi-tenant where it counts: every company lives in its own database schema, behind single sign-on, with permissions enforced in the service layer, not just the interface. Here's how each layer holds, and where to look next.
Defense in depth
Six layers, each doing its job
Hover or tap a layer to see how it works. No single control carries the whole weight.
One sign-on, secured
Everyone authenticates through one secure single sign-on. The same identity carries across the admin app, the storefront, the staff and client portals, and the mobile app, where a native biometric gate stands in front of the saved session.
OIDC + cookie session- One identity across web, portals & mobile
- Short-lived tokens, biometric gate on mobile
Every company in its own schema
Each company's data lives in its own MySQL schema, resolved fresh on every request. A single shared management database holds only cross-tenant metadata like companies, users, licences and modules, so no business tables are ever shared between tenants.
resolved per request- Own database schema per company
- Shared DB holds only metadata, never books
Permissions enforced in the services
Three base roles (User, Power User, Admin) sit over a per-module grid of View, Add, Edit and Delete rights. The checks run in the service layer, not just the interface, so the same rules protect the JSON API and the AI tool calls, not only the buttons on screen.
checked server-side- Per-module View / Add / Edit / Delete
- Enforced in services, so the API is safe too
Requests route up the chain
Cash advances, reimbursements and leave requests climb a line-of-approval built from each person's supervisor chain. Admins assign the supervisors but do not approve the money, the chain decides, and only then can an admin release, settle or pay.
supervisor chain- Advances, reimbursements & leaves routed up
- Admins assign; supervisors decide
Every posting leaves a balanced trail
Any module that touches the ledger, invoices, payroll, loans, donations, produces a balanced, linked journal, and unposting reverses it and reverts the record. The result is a clean, double-entry trail of what changed and when.
Dr = Cr, always- Balanced, linked journal per posting
- Unpost reverses cleanly
The assistant asks before it acts
The built-in AI can run real operations, so it works behind guardrails: view-only users never see the write tools, every action is checked against the modules a company has switched on, and nothing is written until you've seen a summary and confirmed. It reports back only what actually ran.
module check + confirm- Write tools hidden from view-only users
- A module-active check, then a confirm step before any write
One request, every gate
Checked at each step
A single action passes through all six controls before it ever touches the books.
Sign in
Secure sign-on verifies the identity
Resolve tenant
The company's schema is selected
Check rights
The service checks module permissions
Route approval
Money requests climb the chain
Post journal
A balanced entry hits the ledger
Leave a trail
The linked journal stays on record
Keep exploring
Where to look next
See it in action
Click through the real workspace and the mobile app, both fully interactive, with a live description of everything you touch.
Open By industryFind your fit
Six kinds of team, from startups to microfinance, and the companion apps that reach past the back office.
Open PlansCompare pricing
Four tiers with a full feature-by-feature comparison, an upgrade explainer and answers to the common questions.
OpenContact us
Still have questions? We're here to help
Get an instant answer from AI Chat, or reach the team directly. Either way, you're one step from a clearer close.