ERPNext Security Best Practices: Roles, Two-Factor Authentication, Backups, and Hardening

ERPNext is often the single most valuable system a business runs. It holds the general ledger, bank details, customer and supplier records, pricing, stock, and, if you use Frappe HR, employee and payroll data. That concentration of information is exactly what makes an ERP efficient, and it is also why the ERP deserves careful security. The platform gives you strong tools to protect it, but they only work when they are configured deliberately.

This checklist reflects what Softech Global Services applies during ERPNext implementations for clients across manufacturing, distribution, services, healthcare, and nonprofits.

ERPNext security is built on roles. Each role grants permissions on document types, such as read, write, create, submit, cancel, and delete. The most common mistake is giving everyone broad roles because it is quicker during go-live, then never tightening them.

Instead, design roles that mirror real job functions: accounts payable clerk, accounts receivable clerk, finance approver, sales user, sales manager, stock user, purchase user, HR user, and so on. Start from the minimum each person needs and add permissions only when a genuine need appears. Keep the System Manager role for a very small number of trusted administrators, and never use an administrator account for everyday work.

Role permissions control which document types a user can access. User permissions control which records within those types they can see. If you run multiple companies, branches, or territories, restrict users to the company, warehouse, cost centre, or territory they actually work in. A branch salesperson rarely needs to see every customer in every region, and a warehouse user should not see another site's stock.

Fraud and costly errors are far less likely when no single person can complete a sensitive process end to end. Separate the person who creates a supplier from the person who approves bank detail changes. Separate the person who enters a purchase invoice from the person who approves the payment. Use ERPNext workflows so that documents move through draft, review, and approval states, with each step limited to the right role. Make sure cancel and amend permissions are restricted, because cancelling and amending submitted transactions can be used to hide changes.

Passwords alone are not enough, especially for remote access and finance users. ERPNext supports two-factor authentication through an authenticator app, SMS, or email, and it can be enforced per role. At a minimum, require it for administrators, finance, HR, and anyone with access to bank or payroll data. Authenticator apps are generally the most robust option.

In System Settings, enforce a minimum password strength, enable lockout after repeated failed login attempts, and set sensible session expiry so unattended browsers do not stay logged in indefinitely. If you integrate single sign-on through an identity provider, configure it carefully and review which accounts can still log in with local passwords.

Disable accounts immediately when employees leave or change roles. Every quarter, review active users, their roles, and their last login dates. Remove dormant accounts and unnecessary privileges. This simple routine closes one of the most common doors attackers use: old accounts that nobody remembers.

Integrations with e-commerce platforms, payment gateways, FBR e-invoicing, banks, and AI agents usually authenticate with API keys. Create a dedicated integration user for each integration, give it a minimal role, and never generate API keys for an administrator account. Store keys in server-side environment variables, not in code repositories or browser applications, and rotate them when staff or vendors change. Review the integration users periodically, and disable any that are no longer used.

ERPNext creates database backups automatically, but file attachments may need to be included explicitly, and backups stored only on the same server do not protect you from server failure or ransomware. Configure scheduled backups that include files, copy them to a separate, secure location such as encrypted cloud storage, keep several generations, and test a full restore on a separate environment regularly. A backup you have never restored is only a hope.

If you self-host, the server needs the same care as the application:

Managed hosting providers handle much of this for you, but you remain responsible for roles, users, and integrations.

ERPNext keeps version history on documents and records login activity. Use them. Review access logs for unusual login times or locations, track changes to sensitive masters such as suppliers, bank accounts, and the chart of accounts, and alert on repeated failed logins. Auditors appreciate a system that can show who changed what and when.

Security fixes arrive through regular Frappe and ERPNext releases. Plan updates rather than postponing them indefinitely: test on a staging copy, especially if you have customisations, then update production during a maintenance window. Avoid heavy core modifications, because they make updates harder and therefore less frequent.

If any answer is uncomfortable, that is your starting point.

Security is part of every ERPNext implementation we deliver, from role and workflow design to integration users, backups, and handover documentation. We also review and harden existing ERPNext systems. Contact our team for an ERPNext security review and a prioritised list of improvements.