Security
Security and data governance in ELX
Security and data governance in ELX rest on controls built into the system itself: permissions per screen and action, data scoped to branches and districts, an audit log of who changed what and when across master data and key operational records, and a separate instance and database for every company. This page also explains how we protect the elxsa.com website.
Inside the ELX system
Product governance controls
These controls are built into ELX itself, and your system administrator decides each user's permissions and data scope. More in permissions, settings and master data.
Permissions per screen and action
Administrators grant each user their rights on every screen from a single matrix. Users without a right are sent to an access-denied page, and their menu shows only the screens they may open.
- View, add, edit and delete
- Change status and "Show other users' data"
- Relay and Excel import
Branch and district scoping
Each user is linked to their branches, cities and districts, so their lists and dashboard stay within that scope. System administrators see all data.
Work orders open only for their assignee
A user claims an order with "Open" before working on it. From then on only the assigned user can open it, unless someone holds the "Show other users' data" permission. In distribution screens, viewing and assigning are separate permissions.
Audit log with per-record history
Adds, edits, deletes and status changes in master data and in key operational records such as work orders, projects and order distribution are logged with the table, action, user, date and time, and a snapshot of the record. Administrators can open any record's full history.
Manual stage changes need a note
An authorised user can move a work order manually to another stage, but only with a change note. Each change is kept in its own log with the old value, new value, note and date.
Traceable soft delete
Deleting work orders, stock documents and material estimates is a soft delete, so the records stay traceable. A deleted stock document records who deleted it and when, and deleting work orders has its own screen and permission.
A separate instance and database per company
Every company runs its own ELX web instance with its own database, and a user's session is bound to their company's database.
Password reset by email code
Users sign in with their user code and password. A forgotten password is replaced using a code sent to the user's email, and administrators can reset passwords too.
Data isolation per company
Each company's data sits in a database of its own, not in one shared with other companies.
ELX is a cloud service hosted and operated by Matrix, and every company works in its own ELX web instance, connected to its own database. A user's session is tied to their company's database: if that database changes, the session is cancelled and the user has to sign in again. Inside the company a second layer applies, because each user sees only the screens they are permitted to use and the branches and districts assigned to them.
- A cloud service hosted and operated by Matrix, with no servers on your side
- Its own web instance and database for every company
- User sessions bound to the company's database
- Per-screen permissions and branch and district scoping inside the company
Website security: elxsa.com
How this website is protected
This section covers elxsa.com, the marketing website you are reading now, not the ELX system itself.
A static site with no database
Pages are plain HTML generated in advance. There is no server-side code, no database, no admin panel and no sign-in page on this website, so no visitor data is stored in a database.
A strict Content-Security-Policy
Browsers may load scripts and styles only from this domain. Inline code and third-party scripts are blocked, the site is configured so other sites cannot frame our pages, and our CSS and JavaScript files carry integrity hashes.
HTTPS enforced, with HSTS
The site is configured to redirect every request to HTTPS, and the HSTS header tells browsers to keep using HTTPS for this domain on later visits.
No cookies, trackers or analytics
This website sets no cookies and loads no analytics, advertising or tracking scripts. The technical logs a server may keep are described in our privacy policy.
Contact goes straight to WhatsApp
The contact form has no backend. It composes your message in the browser and opens WhatsApp, where you send it from your own account. Nothing you type into the form is stored on this website.
A published security.txt
Our security contacts are published in the standard
/.well-known/security.txtfile on this domain, so researchers know how to reach us.
Responsible disclosure
Found a possible vulnerability in this website or in ELX? We want to hear about it.
Send us a short description through the WhatsApp button on this page, the same channel the Matrix team uses for ELX technical support, or from the contact page. The same contact details are published in /.well-known/security.txt on this domain.
A clear report helps us check the issue quickly. It usually includes:
- The page, screen or address where you saw the issue
- The steps to reproduce it and what you expected to happen
- When you noticed it, and the browser or device you used
- How we can reach you
Please act in good faith: do not access, change or delete other people's data, do not disrupt the service, do not test a live ELX instance that belongs to another company without its permission, and do not put passwords or personal data in your report. Give us a reasonable chance to fix the issue before you make it public.
What this page covers
We describe only the controls we have verified in the product and on this website. If your company has specific security requirements, such as where data is stored, how long it is kept or your internal policies, please discuss them with our team directly.
ELX security and data governance FAQ
Is my company's data separated from other companies' data?
Yes. Every company runs its own ELX web instance with its own database, so its records are not kept in a database shared with other companies. A user's session is bound to their company's database; if that database changes, the session is cancelled and a new sign-in is required. Inside the company, permissions and branch and district scoping add a second layer.
Who hosts and operates ELX?
ELX is a cloud (SaaS) service hosted and operated by Matrix. Your team uses it in the browser with no servers needed on your side, and every company has its own web instance and database. Technical support comes from the Matrix team over WhatsApp. If your company has specific security or contractual requirements, please discuss them with our team directly.
Who can see a work order?
Users see only the screens they are permitted to open, and their lists and dashboard are limited to their branches and districts. Within a stage, a user claims an order with "Open", and from then on only the assigned user can open it, unless someone else holds the "Show other users' data" permission. System administrators see all data.
Is every change in ELX logged?
Not every change. The audit log covers a defined scope: adds, edits, deletes and status changes in master data and in key operational records such as work orders, projects and order distribution, with the user, the time, a snapshot and a full history per record. Manual stage changes are logged separately with a mandatory note, and deleting work orders, stock documents or estimates is a traceable soft delete. More in user permissions and audit trail.
What happens if a user forgets their password?
ELX emails the user a code they use to set a new password, and system administrators can also reset a user's password from user management. Users sign in to ELX with their user code and password.
Does this website store what I type in the contact form?
No. elxsa.com is a static website with no database and no server that receives forms. The contact form builds your message in the browser and opens WhatsApp, where you send it from your own account to the official ELX number. The website sets no cookies and runs no analytics or tracking scripts.
Does your company have specific governance requirements?
Request a demo and go through permissions, data scoping and the audit log with our team, based on how your company works.