01Security
The system runs your data. You control who has access.
Draivix runs on servers in the EU, every company has its own database, and every change or data export is logged. Here is how the system protects your data automatically.
02What the system guards automatically
Every company has its own database
Your company’s data never shares tables with anyone else. Every request is also verified to ensure it belongs to your company.
Two-factor authentication
Password plus a one-time SMS code. After ten failed attempts, the account is locked for 15 minutes and the owner is notified.
Layered permissions
Who can view and do what is governed by roles, record ownership, teams, and field-level permissions. Administrator rights are stored as data, not hardcoded exceptions.
Audit trail
Logins, every record change with field-level diffs, deletions and restorations, and every outbound API data transfer are logged with the user, timestamp, and IP address.
Illustrative example
- login
- record change
- outbound API data transfer
Policy-scoped API keys
An integration or AI key only gets what it needs: selected entities and actions, with an expiration date you control.
Sensitive data encryption
Integration passwords, tokens, and flagged fields are encrypted in the database and masked in both the UI and audit logs.
Client-side encrypted password vault
Company passwords are encrypted right in the browser. The server stores only ciphertext and a log of who revealed each password.
Traffic and runtime protection
Security headers, CSRF and SSRF protection, rate limits on logins and API calls, and HTML sanitization for user content.
Single sign-on via corporate identity providers (LDAP, SAML, OIDC) is not enabled in this version; users sign in with a password and a second factor.