Security in Phi systems

Due to the constant growth of cyber threats, security is not an afterthought or an additional task, but an integral part of the development life cycle.

Although our team pays special attention to security even before writing the first line of code, we are aware that even with the greatest amount of preparation, we would not be able to detect all possible vulnerabilities on our own. That is why our applications are regularly tested by external partners, involving cyber security companies that specialize in this field. These comprehensive vulnerability assessments and penetration tests help us identify and address potential risks in a timely manner, well before new systems are launched or updated.

Protection is currently provided by a number of well-established security solutions that meet industry standards. These include proper configuration of CORS, which prevents requests from unauthorized sources, as well as JWT-based authentication and filtering, which ensures that the content of a message has not been altered during transmission. By using content security policies, we reduce the risk of malicious scripts being executed (XSS), and sanitized inputs (for example, in Excel-based imports) prevent harmful content from being entered.

The safest way to protect ourselves is to tackle the problem at its root, which is why we make it difficult for potential attackers to even access our applications. As an option, we provide two-factor authentication for our users, increasing account security with one-time passwords. Access to our mobile app is also subject to strict conditions: it is only available if our partners use a QR code generated by our web app on their internal network. In the case of our cloud solutions , access is only permitted from predetermined IP addresses.

Of course, the above list is not exhaustive. We deliberately do not share every detail, as part of effective protection is not revealing all of our internal solutions.