About LHAIF Tech

ERP (Enterprise Resource Planning) is a comprehensive software system that integrates and manages all core business processes in one unified platform.

Key Functions:

• Finance & Accounting: General ledger, accounts payable/receivable, budgeting
• Supply Chain: Inventory management, procurement, logistics
• Manufacturing: Production planning, scheduling, quality control
• Human Resources: Payroll, benefits, recruitment
• Project Management: Resource allocation, time tracking

Benefits: Eliminates data silos, provides real-time visibility across departments, automates workflows, and enables data-driven decision making.

CRM (Customer Relationship Management) is a software system designed to manage all interactions and relationships with customers and potential customers.

Key Functions:

• Contact Management: Centralized customer database with complete interaction history
• Sales Pipeline: Track leads, opportunities, and deals through sales stages
• Marketing Automation: Email campaigns, lead nurturing, segmentation
• Customer Service: Support tickets, case management, knowledge base
• Analytics & Reporting: Sales forecasting, performance metrics, customer insights

Benefits: Improves customer relationships, increases sales efficiency, automates marketing efforts, and provides insights into customer behaviour and preferences.

ISO/IEC 27001 is the international standard for Information Security Management Systems (ISMS). It provides a systematic framework for managing sensitive company information, ensuring it remains secure.

Key principles:

• Confidentiality — Only authorised individuals access data
• Integrity — Data is accurate and unaltered
• Availability — Systems and data are accessible when needed

We build software that satisfies ISO 27001 Annex A controls, covering access management, encryption, logging, incident response, and continuous improvement.

Audit support: If your organisation requires formal ISO 27001 certification, we provide the technical documentation, security evidence, and control attestations for all software-related components to support your audit. Available as an additional service.

Argon2id is the winner of the Password Hashing Competition and the OWASP-recommended algorithm for password storage. It is the most secure password hashing algorithm available today.

Why Argon2id is superior:

• Memory-hard — Requires 64–128+ MiB of RAM per hash, making GPU and ASIC brute-force attacks economically impractical
• Side-channel resistant — Hybrid data-dependent and data-independent modes protect against timing analysis attacks
• Configurable cost — Memory, iterations, and parallelism can be tuned to your hardware, ensuring hashes remain secure as computing power increases

Compared to older algorithms:

• PBKDF2 — CPU-only, vulnerable to GPU attacks; now only recommended for FIPS-140 compliance
• bcrypt — Mature but limited to 72-byte passwords and lacks memory-hardness

Every password in our systems is hashed with Argon2id using unique per-user salts. Even in the unlikely event of a database breach, passwords remain computationally infeasible to recover.

TOTP (Time-based One-Time Password) is a secure multi-factor authentication method that generates a unique 6-digit code every 30 seconds using an authenticator app on your phone.

How it works:

• After entering your password, you're prompted for a one-time code
• Open your authenticator app (Google Authenticator, Microsoft Authenticator, Authy, etc.)
• Enter the current 6-digit code — it changes every 30 seconds

Why TOTP? Unlike SMS-based codes, TOTP is resistant to SIM-swapping attacks and works offline. Even if your password is compromised, your account remains protected without the physical authenticator device.

RBAC (Role-Based Access Control) restricts system access based on a user's role within the organisation. Each role is assigned specific permissions, ensuring users can only access the data and functions relevant to their responsibilities.

Example roles:

• Administrator — Full system access and configuration
• Manager — Team oversight, reporting, and approvals
• Operator — Day-to-day task execution and data entry
• Viewer — Read-only access to reports and dashboards

Benefit: Follows the principle of least privilege — each user gets exactly the access they need, nothing more. This minimises the risk of accidental or malicious data exposure.

CSRF (Cross-Site Request Forgery) is an attack where a malicious website tricks a user's browser into performing unwanted actions on a trusted site where they're already logged in — such as transferring funds or changing account settings.

How we protect against it:

• Every form includes a unique, cryptographically generated CSRF token
• The server validates this token on every submission
• Requests without a valid token are automatically rejected

This ensures that only legitimate actions initiated by the authenticated user are processed.

CSP (Content Security Policy) is a security header that tells the browser which sources of content (scripts, styles, images) are trusted. It is one of the most effective defences against Cross-Site Scripting (XSS) attacks.

What it prevents:

• Injection of malicious JavaScript from untrusted sources
• Data theft via inline script execution
• Clickjacking and content embedding attacks

Our CSP headers are configured to allow only explicitly trusted sources, blocking any unauthorised scripts from executing in the browser.

HSTS (HTTP Strict Transport Security) is a security mechanism that forces browsers to only communicate with the server over encrypted HTTPS connections — never over unencrypted HTTP.

What it prevents:

• Man-in-the-middle attacks — Attackers cannot intercept or tamper with data in transit
• Protocol downgrade attacks — Prevents forcing a connection back to insecure HTTP
• Cookie hijacking — Session cookies cannot be intercepted on unencrypted channels

Combined with TLS 1.3 encryption, HSTS ensures all data exchanged between your browser and the application is fully encrypted and tamper-proof.

SOC 2 (System and Organization Controls 2) is an auditing standard developed by the AICPA that evaluates how a service organisation manages data based on five Trust Services Criteria:

• Security — Protection against unauthorised access
• Availability — System uptime and reliability
• Processing Integrity — Accurate and complete data processing
• Confidentiality — Protection of sensitive information
• Privacy — Proper handling of personal data

Type II is the more rigorous variant — it assesses whether controls are not only designed correctly but have been operating effectively over a sustained period (typically 6–12 months).

Cloud-hosted solutions: We can obtain SOC 2 Type II certification for the service on your behalf, providing your organisation with a formal audit report covering all Trust Services Criteria. Available as an additional service.

On-premises deployments: We provide the technical documentation, security evidence, and control attestations for all software-related components to support your own SOC 2 audit. Available as an additional service.