Technical Concerns
The questions an IT-minded person asks before committing a business to a cloud product — answered as precisely as we can, and marked clearly where we cannot.
Security
Q: Is my data encrypted?
Traffic between your browser and the platform is encrypted with TLS — the same protocol your bank’s website uses — so nobody on shared wifi can read what you send.
Q: Who can see my data?
Only the people you authorise, and only the parts you authorise. Access is controlled by role-based permissions down to applet and document level, and each permission set is scoped to a company, branch or location. View and export are separate rights, and the check happens on the server rather than by hiding a button.
Q: Is multi-factor authentication available?
Yes, on the platform’s login service. Turn it on for every account that can see customer personal data, and treat it as non-negotiable for any account that can export.
Q: Is there an audit trail?
Yes for changes. Every create, update and delete on a record stores the old value, the new value, who did it and when, readable by whoever holds the audit-trail permission.
Not for reads. BigLedger does not currently record who looked at a record. If your compliance programme requires read-access logging, that is a development request, not a setting.
What we can and cannot tell you about certification.
BigLedger does not publish a security certification on this wiki. If your auditor, your insurer or your head office asks for an ISO 27001 or SOC 2 statement, a completed vendor security questionnaire, or a data-processing agreement under Malaysia’s Personal Data Protection Act 2010 (PDPA), ask your BigLedger contact — they can tell you what exists today.
Please do not cite this page as evidence of a certification, and be sceptical of any documentation that offers you infrastructure claims — backup frequency, monitoring, data-centre arrangements — without a document behind them. We have deliberately removed such claims from this page rather than repeat them unverified.
Q: What is mine to do?
- Strong, unique passwords, and multi-factor authentication.
- Scope every permission set to a target. An unscoped set confers access to everything and is invisible until somebody uses it.
- Review who holds export rights, quarterly. Fifteen minutes.
- Never share a login. It makes the audit trail worthless, which is the one thing you cannot reconstruct afterwards.
See teams and permissions, which sets all of that up.
Access
Q: What do I need to run it?
A current desktop browser and an internet connection. There is nothing to install on a server, and no special hardware.
Q: Can I use it on a phone?
The interface is a web application; how well any given applet works on a small screen varies, and some are built for a desk. Several parts of the product — the driver applet in particular — are designed for a phone. Check with your BigLedger contact which of the applets you use have a mobile build.
Q: What happens if the internet goes down?
For most of the product: you cannot use it, because it is a cloud service. Plan for that the way you would plan for any single dependency — a phone hotspot is the usual immediate answer.
The exception is POS, which has its own offline sync arrangement so a counter can keep trading and reconcile when the connection returns. It is a setting and a permission, not automatic — confirm your tills are configured for it before you need it. See the POS General applet.
Your data
Q: Can I get my data out?
Yes, three ways:
- Grid export. Almost every listing and report in the product exports to Excel or PDF from its own status bar. If you are copying numbers off a screen by hand, look for the export first.
- File export screens. Several applets have dedicated export screens for their master data — items with their pricing, GL-code and branch links, for example.
- The API. Every record in the product is reachable over a documented REST API, and the reference is generated from the backend’s own route table. See the API reference.
Q: Can I import data in?
Yes, and this is how a migration is done. Most master-data screens carry a CSV import with a Checking tab that validates row by row and tells you exactly which line failed and why. The safe pattern for a bulk change is export, edit, re-import.
Q: What about backups?
This is a question for your BigLedger contact, and we will not restate an infrastructure claim here that we cannot evidence. What you can do on your own account is export the reports and master data that matter to you on a rhythm you choose, using the exports above.
Customisation
Q: How much can we change?
More than most people expect at the configuration level, and less at the code level.
Per applet: default branch, location, pricing scheme and price book; which tabs appear and in what order; which buttons and menus are visible per role; custom statuses; printable formats; e-mail templates; relabelling of fields; placement of tenant custom fields; and webhooks.
Per tenant: which applets exist at all, roles and permission sets, the organisation structure, and the master data.
What is not configuration: the behaviour of a document type — what it posts, what it moves, what it validates. Those are the product. If you need one changed, it is a development request.
Q: Can we build our own?
Yes — there is an applet development path and a documented API. See developer documentation.
What success looks like
Before you commit a business to it, be able to answer:
- Who in my organisation can export the customer list? (And is that the right list of people?)
- Is multi-factor authentication on for those accounts?
- If I needed everything out tomorrow, which three exports would I run?
Common mistakes
| What goes wrong | The fix |
|---|---|
| Permission sets with no target | Scope every one; unscoped means everything |
| Shared logins | The audit trail stops meaning anything |
| Assuming reads are logged | Changes are; reads are not |
| Citing a wiki page as evidence of certification | Ask your BigLedger contact for the actual document |
| Discovering POS offline sync is not configured during an outage | Confirm it before you need it |
| Copying report data by hand | Almost every grid exports |