Data Protection
Effective Date: 1 June 2026 · Last Updated: 12 June 2026
Win Central One is a multi-tenant SaaS ERP platform. Your business data — invoices, contacts, inventory, payroll — belongs to you. We protect it with enterprise-grade security and strict tenant isolation.
How We Protect Your Data
🔒
TLS Encryption in Transit
All data between your browser and our servers is encrypted with TLS 1.3.
🗄️
AES-256 at Rest
Data stored in our database is encrypted at rest using AES-256.
🏢
Tenant Isolation (RLS)
Row-Level Security at the database layer — your data is never visible to other companies.
🔑
Role-Based Access
Admin, Finance, Sales, Warehouse, View-only roles. Each user sees only what their role permits.
💾
Automated Backups
Daily automated backups. Point-in-time recovery available. 30-day backup retention.
📋
Immutable Audit Trail
Every create, edit, and delete action is logged with user, timestamp, and old/new values.
Data Residency
Your data is stored on Supabase infrastructure hosted in secure data centers. We use Cloudflare for global CDN and DDoS protection. All infrastructure providers are contractually bound to our data protection requirements.
Who Can Access Your Data
- You and your team: Users you invite to your account, based on their assigned roles.
- Win Central support staff: Only with your explicit permission for support purposes, and only the minimum data necessary.
- No third parties: We do not share, sell, or rent your business data to any third party for commercial purposes.
Data You Own
You retain full ownership of all data you input into Win Central One, including:
- Customer and supplier contacts
- Sales orders, invoices, and receipts
- Purchase orders and bills
- Inventory and product data
- Employee records and payroll data
- Financial journal entries and reports
- All other business records
Data Export
You can export your data at any time in CSV or Excel format from Settings → Import/Export. We do not lock you in. If you decide to leave, you take your data with you.
Data Deletion
When you cancel your account:
- Your data remains accessible for 90 days (recovery window).
- After 90 days, all data — including backups — is permanently and irreversibly deleted.
- You may request immediate deletion by contacting privacy@wincentralone.com.
Third-Party Integrations
When you connect third-party services (Zoho Books, Shopify, etc.):
- Data is synced only with your explicit authorization.
- We store integration credentials (API tokens) securely using environment-level secrets — never in plain text.
- You can disconnect any integration at any time from Settings → Integrations.
Incident Response
In the event of a data breach or security incident:
- We will notify affected tenants within 72 hours of discovery.
- We will provide details on what data was affected, what we have done, and what you should do.
- We will work to remediate the issue as quickly as possible.
Compliance
Win Central One is designed with the following standards in mind:
- Myanmar data protection practices
- IFRS/MFRS accounting standards for financial data integrity
- OWASP Top 10 security best practices
- SOC 2 principles (security, availability, confidentiality) — formal certification planned
Contact Our Data Protection Team
See also: Privacy Policy · Terms of Service