Fortexa ERP
TermsPrivacyCookies

Information Security Policy

Last updated:

Responsible entity and jurisdiction

Fortexa ERP is operated by CLOUDTEXA SOLUTIONS, S.R.L. (RNC 133627515), located at George Washington No. 508, sector Gazcue, Santo Domingo de Guzmán, Distrito Nacional, República Dominicana. In this document, “Fortexa ERP”, “we” or “the Company” refer to that entity.

  • Legal name: CLOUDTEXA SOLUTIONS, S.R.L.
  • RNC: 133627515
  • Address: George Washington No. 508, sector Gazcue, Santo Domingo de Guzmán, Distrito Nacional, República Dominicana
  • WhatsApp: +1 (849) 485-9375
  • Email: info@fortexaerp.com

Governing law: this document and the relationship with the user are governed by the laws of the Dominican Republic. Any dispute shall be submitted to the competent courts of Santo Domingo, Distrito Nacional, unless mandatory law of the user’s country provides otherwise. Translations are provided for convenience; in case of discrepancy the Spanish version prevails.

Automatically translated with AI · The Spanish version prevails legally.

This Information Security Policy defines the controls, principles, and responsibilities that Fortexa ERP applies to protect the confidentiality, integrity, and availability of the information it manages as an enterprise management platform and Electronic Invoicing Service Provider before the Dirección General de Impuestos Internos (DGII) (General Directorate of Internal Taxes) of Dominican Republic.

1. Scope

This policy applies to all Fortexa ERP systems, services, databases, integrations, and personnel involved in the processing of taxpayer information, including the issuance, signing, transmission, and preservation of electronic tax receipts (e-CF).

2. Security Principles

  • Confidentiality: information is only accessible by authorized users.
  • Integrity: information is kept accurate and complete; all changes are recorded.
  • Availability: services are designed to operate continuously.
  • Least Privilege: each user and component accesses only what is strictly necessary.
  • Traceability: sensitive actions are recorded in immutable audit logs.

3. Access Control

  • Authentication using individual credentials and expiring JWT tokens.
  • Passwords stored exclusively with bcrypt hash (never in plain text).
  • Role-based access control (RBAC) with granular permissions per module.
  • Multi-company isolation: each taxpayer's data is logically separated by company.
  • Audit logging of logins, including failed attempts and brute-force lockout.

4. Data Protection

  • Encryption in transit via TLS 1.2 or higher in all communications.
  • Encryption at rest (AES-256) in the storage infrastructure.
  • Taxpayer digital certificates are stored encrypted and only used for e-CF signing authorized by the holder.
  • Service keys and credentials are managed using secure environment variables, never in source code.

5. Security in the Electronic Invoicing Cycle

  • Electronic tax receipts (e-CF) are digitally signed in accordance with the technical standards of DGII.
  • Validation of authorized NCF/e-NCF sequences and duplicate control across all modules.
  • Full traceability logging for each receipt: issuance, signing, transmission, acknowledgment, and status before DGII.
  • Separate certification (TesteCF) and production environments.

6. Event Log and Change Control

Fortexa ERP maintains an event log that allows for traceability and change control, including:

  • Auditing of actions (creation, modification, cancellation, and deletion) on tax documents, accounting entries, payments, and catalogs.
  • History of movements per entity with user, date/time, and change details.
  • Access auditing (login/logout, IP, device).
  • Retention of logs in accordance with applicable legal deadlines.

7. Vulnerability and Incident Management

  • Regular updates of dependencies and security patches.
  • Real-time monitoring of errors and anomalous events.
  • Incident response procedure: identification, containment, eradication, recovery, and lessons learned.
  • Notification to affected clients and competent authorities when required by law.

8. Personnel Security

  • Confidentiality agreements with all personnel with access to client information.
  • Restricted, named, and audited administrative access.
  • Immediate revocation of access upon termination of employment or contractual relationship.

9. Compliance

This policy is complemented by the Personal Data Protection Policy (Ley 172-13 [Law 172-13]), the Contingency Policy and the Backup and Recovery Procedures. Compliance is mandatory for all Fortexa ERP personnel and systems.

10. Review and Contact

This policy is reviewed at least once a year or in response to significant changes in the platform or regulatory framework. Security inquiries: seguridad@fortexaerp.com.

Instalar Fortexa como app

Acceso rápido desde tu pantalla de inicio.