Security

How it is actually built.

Not a badge wall. If a question here is not answered, ask it on the call, including where the answer is still 'not yet'.

Isolation at the database, not in the app

Each customer is an organization row, and every business table carries its organization. Row level security resolves the caller's organization and returns only those rows, so a missed filter in application code cannot leak another customer's data.
Invite only, by design

There is no public signup. An organization is provisioned by the Mr Sales team and its owner is invited by email. Owners, admins and HR then manage logins inside their own organization.
Field logins that suit a field team

A rep signs in with the company code, an employee ID and a password their manager set, and is forced to change it on first use. The organization is resolved from the company code, so one app serves every customer without a per-customer build.
Role and plan gates

Every module is gated twice: by the plan the organization holds, and by the role the login carries. Owner, admin, HR, finance, IT and management do not see the same console, and a rep's phone sees a different product again.
An audit trail that attributes change

Configuration and record changes are attributed to the login that made them. Approvals keep who decided what, and when.
Location as evidence, stated honestly

A point is captured when a visit is recorded and when a day plan is submitted, each with a verdict: verified, unverified, or a mocked position flagged as a compliance event. There is no continuous stream, and the product does not claim one.

Surfaces

Four addresses, four audiences.

This page holds no customer data and asks for no login.

mrsales.in Public This site. No customer data, no login, no session.
app.mrsales.in Customers The tenant console, scoped to one organization after sign in.
Phone app Field users The same backend, with the organization resolved from the company code.
ops.mrsales.in Mr Sales only Internal provisioning, plans, billing and support. Never public.

No certifications yet. We hold no ISO or SOC attestation, and we will not put a badge on this page until an auditor has issued one.
No uptime number. We will not publish a figure we are not yet contractually standing behind. Ask about availability commitments during the commercial conversation.
No live tracking. The phone captures location at a visit and at day-plan submission. It does not follow a rep through the day, and any product that tells you otherwise is describing a different one.
No customer list. We are not going to decorate this site with logos we have not earned the right to show.

Bring the questions your security review actually asks. We would rather answer them before a contract than discover them after one.

We reply within one working day.