Governance isn't a feature bolted on — it's the foundation URBIS is built on.
Every request is checked three times: middleware resolves the tenant from the authenticated session, a global query filter narrows every database read to it, and the handler re-checks the record it is about to touch. A filter missed in one layer cannot leak data past the other two.
Every create, update and delete is written with the actor, the timestamp and the values before and after — including the operator behind an access-on-behalf session. The trail goes past changes: approvals and rejections, printed documents, exports, file views and downloads are recorded too, so you can answer who read a document, not only who edited it. Audit records are append-only: the application has no path that edits or deletes one.
Rights are granted per module and per action, and every gate is enforced on the server — hiding a button is never the control. Where scope matters the grant narrows further: to a department's assets, to a single warehouse, or to one row.
A policy filters the rows a user may read, and a column rule hides the fields they may not see. Both are defined once and applied to every query the module runs, rather than re-implemented screen by screen — which is what makes "the list and the report agree" a property of the system instead of a review task.
A record can be shared with a user or a group without widening their role. The grant is explicit, bounded and recorded — so an exception stays an exception instead of quietly becoming a permanent permission.
A tenant can connect its own identity provider, so people sign in with their institution's account and removing them from that directory removes their access here. Password policies, history and reuse rules apply to the accounts that stay local.
Support or administrative access as another user requires an explicit grant that is scoped and time-boxed, and every action is recorded against both the operator and the user. No silent back doors, and no shared admin account.
Sign-in can require a one-time code delivered by email on top of the password, switched on per tenant. Sessions are invalidated centrally, so revoking access takes effect on the next request rather than the next login.
Attachments are encrypted at rest with keys held in a secure store rather than in configuration files, and database backups inherit the storage layer's encryption.
Run URBIS inside your own environment or in the cloud — the same complete platform either way, so a data-residency policy never costs you features.
Accrual accounting, journals and reconciliation are modelled for public-sector IPSAS and enterprise IFRS from the start, so the year-end audit reads the system's own records instead of a spreadsheet rebuilt for the auditor.
Your data is exportable in full, at any time, in open formats. The way out is part of the product rather than something to negotiate — which is what makes the way in a low-risk decision.