Cobalt ERPKeep responsibility clear as work moves forward.
Permissions, approvals and history around your business records.
Control who can view records, prepare work and approve changes. Follow the transactions and decisions behind a result, including work prepared by Intelligence and agents.
Give people access that fits their role.
Set access and approval responsibilities around the work each person does. Keep the record of actions available for review as orders, invoices and other transactions move forward.
Eight levels, set skill by skill for your business
You decide how much each skill may do, one skill at a time, for your business only. At the top three levels, nothing is applied without a person or a rule you have named.
From here, a person or a rule you have named must approve
Nothing edited away
Corrections are added as new entries that point back to the original, so you can trace any figure to what caused it and who approved it.
Role-based permissions
Every user has a role, every role has clear permissions, and approval limits are set for each company instead of assumed.
Single sign-on
Single sign-on is available on Premier and above, so you add and remove staff accounts in the sign-in system you already use, instead of tracking them in a spreadsheet.
A live kill switch
One switch stops every agent at once, across every module, without undoing work that is already done.
An agent can't do anything a person in that role couldn't.
Cobalt ERP Intelligence follows the same permissions as your staff and can't give itself more access. Anything that posts to the books, sends a message or commits money waits for a person with the right permission to approve it.
- You decide how much agents can do — eight levels, from only explaining things to carrying out small actions within set limits. An administrator raises the level one task at a time.
- Limits are checked where the action happens — spending and volume limits are checked by Cobalt ERP itself at the moment of the action, so they can't be got around from the screen.
- Every action is signed — the history records which agent acted, on whose authority, at what level, and based on what information.
- Refusals are clear — when a rule blocks an action, Cobalt ERP tells you which rule, instead of quietly doing something else.
- Your data isn't used for training — your records are read to answer your questions and are not used to train AI for anyone else.
Where your data lives, and how you get it back.
Encrypted in transit and at rest
Every connection is encrypted, and so is your stored data, including backups.
Backups and recovery
Backup scheduling and recovery are part of the service. The retention period, restore-test evidence and recovery point and recovery time commitments for your deployment are shared on request and set out in your agreement.
Export, always
CSV export is included on every plan. API access is included from Scale. Request the approved agreement for post-subscription export and retention periods.
Isolation on request
Enterprise runs on a private Cobalt Cloud, with its own data storage, its own servers and its own separate network.
Certification and assurance.
Cobalt ERP is generally available. Here is exactly what is certified and what is shared on request.
Cobalt ERP is not currently certified to ISO 27001 or SOC 2. The controls on this page are in place, but they have not been checked by an outside auditor. If formal certification is part of your procurement, talk to us and we will take you through the controls in detail.
Our privacy notice, data processing agreement and sub-processor list are available, and the company-specific details for your contract are provided on request.
To report a vulnerability, email support@cobalterp.com with the detail and we will acknowledge it. Please give us a reasonable window to fix an issue before disclosing it publicly.
Frequently asked questions.
Is Cobalt ERP ISO 27001 or SOC 2 certified?
Not today. The controls on this page are in place but have not been checked by an outside auditor. We would rather say so than suggest a certificate we don't hold. If you need one for your procurement, talk to us.
Can Cobalt ERP's AI agents change my data on their own?
Only at a level you have turned on for that task, and within limits you set that Cobalt ERP checks itself. By default, agents prepare work and wait for a person. Anything that posts to the books, sends a message or commits money needs approval from a person with the right permission. A live kill switch stops every agent at once.
Is my data used to train AI models?
No. Your records are read to answer your questions and are not used to train AI for anyone else.
Where is my data hosted?
Hosting providers, regions and transfer arrangements are shared on request and set out in your agreement. Enterprise includes private cloud deployment; confirm its location in your agreement.
How do I get my data out?
CSV export is included on every plan; API access is included from Scale. Request the approved agreement for post-subscription export and retention periods.
Security questionnaire to fill in?
Send it over. We will answer every question clearly and in full.
Talk to us