You are being asked to put your entire asset register, your people and your costs into somebody else's hosted system. This page is what we would want to read before doing that: how the isolation actually works, what is encrypted, what is logged, and which controls we do not have yet.
Isolation
Most multi-customer systems keep tenants apart with a WHERE clause in application code, which works until one query is written without it. In Solmex the separation is a PostgreSQL row-level security policy on every tenant table, forced to apply to the database owner as well, so a query that does not name a tenant raises an error rather than quietly returning somebody else's rows. Getting that wrong is not a bug we could ship: it is a query that fails.
Every connection is HTTPS with modern TLS and HSTS, and the application origin accepts traffic only through Cloudflare, so nothing reaches it directly. Backups run nightly to off-site storage, and a verification job checks them and raises an alert if a backup silently stops working, which is the failure that actually happens.
Changes to equipment, users, roles, work orders, stock, costs and permits are written to an audit log with the old value, the new value, who made the change and when. Separately, a session log records who accessed the system and when, which the change log structurally cannot answer because it only holds rows for things that changed.
Access is granted per module and per action, so a storeman can be given stock movements without the workforce register and a director can approve purchase orders without being able to raise them. Sign-in is rate limited per address and per account, and protected by a bot challenge that runs before anything touches your account.
No. Every customer is a separate tenant and the separation is enforced by PostgreSQL row-level security on 95 tables, applied to the database owner as well as to ordinary roles. A query that does not name a tenant raises an error rather than returning rows, so the failure mode is an outage for us, never a leak for you.
Yes, at any time and without asking us. Settings has a data export that produces a zip of CSV files covering 17 categories and 58 datasets, plus a manifest, and it can be run once or on a schedule. It stays available even if a trial lapses, because a lapsed trial is exactly when somebody needs their records. Registers also export to Excel from the pages you work in, and generated documents are PDFs you keep.
No, and we will not imply otherwise. Solmex is a young product and neither certification has been undertaken. What exists instead is described on this page and is checkable: database-enforced isolation, an unprivileged application role that is not a database superuser, migrations run by a separate credential the application process never holds, verified nightly backups, and an audit trail. If a certification is a procurement requirement for you, tell us before you start a trial rather than after.
Four things worth stating plainly. There is no single sign-on or SAML, so accounts are managed in Solmex. There is no customer-managed encryption key. There is no formal penetration test report to share. And two-factor authentication is not yet available on user accounts, which is the gap we would close first. None of these is hidden behind a sales conversation.
Bring your security questionnaire to the demo. We would rather answer it in front of you than send a document that agrees with itself.
NO COMMITMENT · YOUR DATA STAYS YOURS