Qila ERP · Security centrePrivate deployment
Installed on infrastructure you control, in the region you choose. No vendor access.
Security & data sovereignty
Your data stays yours.
Qila runs on your server. No business data, documents or backups ever leave it. The only outbound connection is a signed hourly licence check-in, and Qila shows you exactly what it sends.
Two-factor sign-in
Authenticator codes, mandatory for administrators; PIN sign-in and idle lock for shared devices.
Granular access
Roles, record scope and field rules decide who sees and changes what, down to a single field.
Segregation of duties
Conflicting powers are flagged before they are granted to one person.
Tamper-evident audit
Every change with who, when, IP, old and new values, hash-chained and verified.
Encrypted backups
Encrypted with your own passphrase, scheduled, and restorable from the screen.
Signed licence check-in
Qila shows exactly what it sends.
No business data ever leaves your server. The only outbound connection is a signed licence check-in. These are the only fields it carries, and you can read them on screen at any time:
- "installation_id": Installation ID
- "licence_key_last4": Last 4 characters of the licence key
- "qila_version": Qila version
- "site_url": Site address
- "users_companies": Number of users and companies
- "modules_packs": Enabled modules and packs
- "last_backup": Last backup time
- "php_db_versions": PHP and database versions
Helps you meet data-protection obligations under
- India DPDP Act 2023
- UAE PDPL
- Saudi PDPL
- EU GDPR
Layers of protection
Security that is on by default.
Self-hosted installation
Qila is installed on your own server or a cloud server you control, in the region you choose. Data, documents and backups stay there.
Two-factor sign-in
Authenticator-app codes, mandatory for administrators. PIN sign-in and idle lock for shared counters.
Field-level permissions & record scope
Decide who sees and changes what — by role, by owner or branch, down to a single field that can be hidden or locked.
Segregation-of-duties checks
Conflicting powers (for example, creating a supplier and approving its payment) are flagged before they reach one person.
Hash-chained audit trail
Every change is recorded with who, when, IP address and old and new values. The chain is verified on a schedule, so tampering is evident.
Encrypted backups
Scheduled backups encrypted with your own passphrase, restorable from the screen.
Your infrastructure, your responsibility
Because Qila runs on infrastructure you choose and control, maintaining the server and keeping regular, tested backups is the client’s responsibility. Qila ERP and ABR Studio are not responsible for data loss caused by failures of the client’s hosting, server, network or backups. Read the data-responsibility notice
FAQ
Questions, answered.
Where is Qila installed?
On your own server or a cloud server you control. ABR Studio or a Qila Expert sets it up for you, online or on site.
Can ABR Studio see my data?
No business data leaves your server. The only outbound connection is a signed licence check-in, and Qila shows you exactly what it sends: the installation ID, the last 4 characters of the licence key, the version, the site address, the number of users and companies, enabled modules and packs, the last backup time and the PHP and database versions.
Who is responsible for my server and backups?
You are. Qila runs on infrastructure you choose and control, so keeping the server maintained and taking regular, tested backups is the client’s responsibility. Qila includes encrypted, scheduled backups to make that easy.
What server do I need?
A Linux server with PHP and a database, on your own hardware or a virtual server (VPS) from a provider you choose. For up to 10 users a small VPS of about $10–20 a month is usually enough; your Qila Expert sizes the server as users grow.
Where are backups stored?
Wherever you choose. Backups are scheduled, encrypted with your own passphrase and restorable from the screen. Keep a copy in a second location and test a restore regularly.
Can ABR Studio access my server?
Not by default. Qila is installed on infrastructure you control, with no vendor access. If you want hands-on help on the server, you grant that access yourself and can withdraw it at any time.
What does the audit trail record?
Every change, with who made it, when, from which IP address, and the old and new values. Submitted documents are locked, and the hash-chained trail is verified on a schedule so tampering is evident.
Let’s talk
Build your fortress.
See Qila working with your own processes. Book a personalised demonstration with our team.