What security covers
Security in Predictiv is about three questions. Who can see and change which records? What happened, and who did it? Where does the data live, and who can reach it? This page describes the controls the product gives you. For how those controls are engineered and tested, see Predictiv assurance.
Identity
Every person signs in with their own account. Staff sign in to the ERP with their Predictiv identity, and can also sign in to Atrium with a Google account. Integration accounts and external AI tools sign in as a named account too, so Predictiv attributes every action to someone.
Roles and access
Access is granted by role. A role sets which windows, reports and processes a person can use, which organisations they can work in, and which actions they can take. Workflow adds a further layer: who may approve each step, with thresholds and no self-approval, as described under workflow and approvals.
The same role applies on every channel. The ERP screens, the mobile apps, the till, Atrium, the Predictiv Assistant and external AI tools all check the same permissions. A question put to the AI returns only data the person could open on screen.
Data isolation
Organisations within a group are kept apart by the data model, so each organisation sees its own ledger, stock and documents unless a role grants more. Business partners are isolated in the same way. On the partner portal, a customer sees only its orders and statement, and a supplier sees only its purchase orders and payments. That separation is enforced below the screen, on every channel.
Audit trails
Predictiv records who created each record, who last changed it and when. For each workflow transition, it records who acted, from which status, and with what comment. Stock count entries and approved variances cannot be edited, and corrections are new entries. Requests from the Predictiv Assistant and from external AI tools are logged against the person who made them.
Deployment options
You choose where Predictiv runs. Syntegra can host it in the cloud, or you can run it on your own servers or with a cloud provider you choose. Where regulation requires data to stay in the country, Predictiv can be hosted there. The software is the same in every case.
Audited remote support
Support engineers diagnose problems through a broker that can read a customer’s instance but can never write to it. Access is granted per engineer and per instance, and every read is logged to a named person. You can see who looked at what, and nobody on the support side can change your data.
Logging, backup and recovery
The application and its services write operational logs, so faults can be diagnosed from evidence. Instances that Syntegra hosts are backed up on a schedule and can be restored from those backups. Where you host Predictiv yourself, you run backups on your infrastructure, and Syntegra can help set them up.
Shared responsibilities
Security is shared. Syntegra is responsible for the product’s controls, for the security of instances it hosts, and for how its support team reaches your data. You are responsible for who you give accounts to, which roles they hold, removing access when people leave, and, where you host Predictiv, for the servers, network and backups. Your contract sets out the detail for your deployment.
How it connects
The same controls apply across Predictiv. Integration uses the same roles for APIs and AI tools. Workflow uses them for approvals. Atrium and the portal apply them to control what each outside party can see.