Website and ERP separation
Website accounts, enquiries, quotations, payments, onboarding, and provisioning references are maintained separately from ERP tenant operational databases.
Security
Separation and controlled access across the website and ERP
Security is designed around limited data collection, role-aware access, signed payment events, server-side secrets, and separation between commercial website records and customer ERP operations.
Customer and staff authorization
Customer and internal staff routes use separate role checks so customer accounts cannot access internal administration pages.
Payment verification
Razorpay webhook signatures are verified and payment events are processed idempotently before an order is treated as paid.
No saved payment instruments
Card, bank, and UPI credentials, reusable payment tokens, card metadata, and complete provider payloads are handled by Razorpay and are not stored in the Pharma Setu ERP website database. Only minimal transaction references and reconciliation fields are retained.
Server-side secrets
Database, payment, email, and infrastructure credentials remain server-side and are not intentionally exposed in browser bundles.
Operational event history
Payment, provisioning, quotation adjustment, training assignment, and status events retain actor and timestamp context for administrative review.
Security also depends on the selected deployment, HTTPS configuration, administrator practices, access reviews, endpoint protection, backups, monitoring, and customer operating procedures. Specific commitments should be confirmed in the applicable agreement.
Authorized review, controlled issue, and acknowledgement
The representative lifecycle shows where role-authorized review, approval, controlled distribution, training, and acknowledgement can contribute supporting event history. Representative workflow illustration; configuration and responsibilities vary by implementation.