Zeyto Academy · Advanced · Module 10
Controls, users and audit
Users and roles, sign-in security, approvals, amend vs delete, audit trail, period locks, backups and where your data lives.
You will be able to
- Design users, roles and branch limits using least privilege
- Configure sign-in rules and respond to leavers and lockouts
- Set up an approval rule and follow a document through it
- Correct posted documents with amend and cancel instead of deleting
- Use the audit trail, period locks and backups to protect the books
- Explain cloud, private cloud and on-premise in plain words
Users, roles and permissions
- A user holds roles; roles hold permissions.
- Limit people by branch, cost visibility, price, discount and credit override.
- Users are set Inactive, never deleted; the last Admin is protected.
- Least privilege and separation of duties are the goals.
Passwords, lockouts and sessions
- Security Policy covers the whole installation.
- Defaults: 8 characters, 5 failures in 10 minutes, 15-minute lockout.
- Lock a leaver at once; do not delete.
- No password expiry or two-step sign-in yet.
Approval workflows
- A rule holds a document until named approvers agree; then the requester submits again.
- Self-approval is blocked by default.
- Changing a document after a decision restarts approval.
- The Workflow Approvals definitions screen does not hold documents.
Amend, cancel and why Zeyto does not delete
- Posted documents are corrected by Amend or Cancel, never edited or deleted.
- Amend keeps the number with /A1; Cancel keeps the number as Cancelled.
- Masters are set Inactive; the Recycle Bin is for masters only.
- Amend and Cancel are refused when later documents or locked periods are involved.
The audit trail
- Every save, change, removal and action is logged with who and when.
- Old and new values are kept for masters and documents; secrets show as ***.
- Timeline gives the story of a single document.
- Sign-ins have their own tab.
Locking periods
- Fiscal years, Books locked up to, filed VAT periods and the year-end close all block postings.
- Books locked up to is inclusive and is a soft close.
- The close moves net profit into retained earnings.
- An override needs a special permission and a written reason.
Backups and restore
- A backup is trusted only after a restore test.
- Passphrases are never stored; losing one loses the backup.
- A restore replaces every company and loses later entries.
- Follow 3-2-1: keep a copy away from the shop.
Where your data lives: cloud, private cloud and on-premise
- Cloud, private cloud and on-premise differ in where the database sits and who runs it.
- Zeyto runs on your own server or private cloud; daily work does not need the internet.
- An expired licence makes Zeyto read-only; data is never deleted.
- To move computers: backup, restore, release, activate.
Users, roles and permissions: key table
| Standard role | What it is for |
|---|---|
| Admin | Can do everything and ignores the permission list. Keep very few. |
| Sales | Creates, submits and prints sales documents, sees items and stock, views reports. Cannot amend, cancel or export. |
| Cashier | Works the POS till and can look up sales documents and items. |
| Accountant | Accounting, VAT, Reports and Purchase in full, and can view Sales. |
Passwords, lockouts and sessions: key table
| Setting | Shipped value | Range |
|---|---|---|
| Minimum password length | 8 | 6 to 64 |
| Require a digit | On | Upper-case, lower-case and symbol are off |
| Failures before lockout | 5 | 3 to 50 |
| Counting window | 10 minutes | 1 to 1440 |
| Lockout duration | 15 minutes | 1 to 1440 |
| POS PIN length | 4 digits | 4 to 8 |
Amend, cancel and why Zeyto does not delete: key table
| Action | What happens | Number |
|---|---|---|
| Amend | Zeyto reverses the old posting and posts the corrected version | Same number with a suffix /A1, then /A2 |
| Cancel | Zeyto reverses everything; nothing replaces it; read-only afterwards | Same number, status Cancelled |
| Delete | Not available for posted documents or drafts | Not applicable |
The audit trail: key table
| Column | Meaning |
|---|---|
| Time | Date and time in your company format and time zone |
| Form | The screen the record belongs to, for example Sales Invoice |
| Action | Create, Update, Delete, Submit, Cancel, Approve, Restore, Purge or Denied |
| Done By | The user name, or system |
| Changes | A summary such as 2 changed; click the row for the Old Value and New Value of each field |
Locking periods: key table
| Layer | Where | What it does |
|---|---|---|
| Fiscal Years | Settings ▸ Fiscal Years | A document needs an open year covering its date. Status Closed refuses Submit, Amend and Cancel dated inside that year. |
| Books locked up to | Settings ▸ Posting Controls | A date you choose, inclusive. Documents dated on or before it cannot be submitted or amended. A soft close, separate from fiscal years. |
| Filed VAT period | VAT return | VAT-related documents dated in a filed VAT period cannot be submitted, amended or cancelled, even if the year is open. |
| Year-end close | Year End screen (Accounting module) | Posts closing vouchers and locks the year. |
Where your data lives: cloud, private cloud and on-premise: key table
| Model | Where the database is | Who runs it | Internet needed? |
|---|---|---|---|
| Cloud (shared service) | The provider's data centre, often shared with other customers | The provider | Always |
| Private cloud | A server dedicated to you in a data centre or region you choose | You or a partner, on rented hardware | To reach it |
| On-premise | A computer or server in your own office | You | Only for outside access |