# Security, access control and deployment

Security, access control and deployment in Tranexio cover five-dimension permissions with a permission simulator, multi-tenant and multi-entity isolation, Chinese national SM2/SM4 cryptography and full audit logging. SaaS, private and hybrid cloud run the same code, and Chinese domestic IT stacks (信创, xinchuang) can be supported project by project.

## Key points

- **Five-dimension permissions**：Menus, buttons, data, fields and APIs are authorised independently, data permissions cascade through the organisation hierarchy, and role segregation and temporary grants are supported.
- **Permission simulator**：Administrators can preview the menus, data and fields visible to any account, checking before go-live that access is neither too broad nor too narrow.
- **Tenant and entity isolation**：Multi-tenant SaaS uses field-level isolation with an optional dedicated data source per tenant; new documents carry their legal entity automatically, and cross-entity actions are logged.
- **National cryptography and encryption**：Passwords are transmitted with SM2 encryption and sensitive fields stored with SM4 encryption, with support for API message encryption, XSS protection and rate limiting.
- **Full audit logging**：Operation, API and error logs are recorded in full and can be exported; cross-tenant access by super administrators is restricted by an allowlist and logged.

## The problem

A trade system holds contract prices, customer credit, hedge positions and customs credentials, so overly broad access is a business risk in itself. Group customers also require private deployment, domestic IT stacks and traceable audit. Tranexio treats all of this as core capability rather than project-by-project patches.

## What the platform does: permissions and isolation

| Dimension | What it controls |
|---|---|
| Menus | Which functions a user can open |
| Buttons | Which actions a user can take, such as create, approve, void or export |
| Data | Which organisations’, legal entities’, departments’ or own documents a user can see |
| Fields | Which fields a user can see or edit, such as cost, margin and price |
| APIs | Which open APIs a user can call |

- Role segregation (a conflict-of-duties matrix), automatic revocation of temporary grants on expiry and one-click handover when staff leave.
- Multi-tenant plus multi-entity isolation: business documents carry their operating entity by design, so consolidation needs no mapping tables.

## Security controls

- Image or behavioural CAPTCHA, SMS sign-in and lockout after failed attempts; connection to enterprise identity (OIDC / CAS) is available.
- SM2 password transmission and SM4 field encryption; API message encryption; XSS protection; rate limiting and API keys.
- External system credentials are stored encrypted and called only through the [integration hub](https://tranexio.com/en/platform/integration-hub/).
- Operation, API and error logs are kept in full and can be searched and exported.

## Deployment options

| Option | Details |
|---|---|
| Multi-tenant SaaS | Field-level isolation in a shared database, with an optional dedicated data source per tenant |
| Single-tenant private | Offline installation and upgrade packages, licence certificate activation, can run on an internal network |
| Hybrid cloud | Core data deployed privately, with collaboration and external portals in the cloud as needed |

- Database: supports MySQL and is adapted to Chinese domestic databases such as Dameng.
- [Xinchuang](https://tranexio.com/en/resources/glossary/xinchuang/): private deployments can be supplied as ARM64 (aarch64) offline packages with domestic JDKs, adapted per project to domestic CPUs, operating systems and middleware.

## FAQ

### Can Tranexio be deployed in our own data centre?

Yes. Single-tenant private deployment uses the same code as SaaS, with offline installation and upgrade packages, configuration templates and licence certificate activation. It can run on your internal network, keeping sensitive credentials such as customs declaration certificates inside your network.

### Do you support Chinese domestic databases and xinchuang environments?

Tranexio supports MySQL and is adapted to Chinese domestic databases such as Dameng; the framework includes drivers and dialects for several domestic databases, and private deployments can be supplied as offline packages for ARM64 and domestic JDKs. Specific combinations of chip, operating system and database are adapted and validated in each project.

### Can it meet Multi-Level Protection Scheme assessment requirements?

The platform is designed to security requirements such as MLPS 2.0 (等保 2.0) Level 3, providing identity authentication, access control, encryption and auditing. The MLPS assessment of a specific system is organised by the deploying organisation for its own environment, and we provide supporting materials and technical assistance.

### How do we stop staff seeing data they shouldn’t?

Five-dimension permissions limit data scope to an organisation, legal entity, department or the individual, and field permissions hide sensitive columns such as cost and profit. Before go-live, the permission simulator checks each account; in operation, segregation-of-duties checks and permission audits apply.

---
Source：https://tranexio.com/en/platform/security-deployment/ · Updated 2026-10-06 · © 上海赛淘数据技术有限公司 / Shanghai Saitao Datatech Co., Ltd