Cloud MLM Software provides two-factor authentication with time-based one-time passwords (TOTP), bcrypt password hashing, rate-limited sign-in and password reset, role-based access control with default-deny permission checks, JSON Web Token sessions with token blacklisting, and HMAC-SHA256 signed webhooks. Card payments are handled by Stripe, PayPal, and Revolut, and card numbers are not stored. It offers a self-hosted option, so in a self-hosted deployment your data stays in your own custody. Cloud MLM Software does not claim SOC 2, ISO 27001, or PCI-DSS certification.
Cloud MLM Software Security
Built as a Laravel application with two-factor authentication, role-based access, and gateway-handled payments. Because you can self-host it, your data can stay in your own custody. Here is exactly what the platform does, and what we do not claim.
Autenticazione a due fattori TOTP, hashing bcrypt, login con tentativi limitati.
Sessioni JWT con revoca dei token, webhook firmati HMAC-SHA256.
I pagamenti con carta passano dai gateway; i segreti di integrazione sono cifrati a riposo.
Con il self-hosting il database resta sotto la tua custodia.
Access and authentication
Time-based one-time passwords (TOTP) with any authenticator app such as Google Authenticator. Admins can require it, and the platform withholds the session until the code is verified.
Login and registration are throttled, and password-reset requests are throttled harder, to blunt brute-force and credential-stuffing attempts.
Passwords are hashed with bcrypt. They are never stored in plain text, and password-reset tokens expire.
Super-admin, sub-admin, and user roles. Sub-admin permissions are checked against a stored permission set on every admin route, and access is denied unless explicitly granted.
Data and payments
| Control | How it works |
|---|---|
| Payments handled by the gateways | Card payments are processed by Stripe, PayPal, and Revolut. Cloud MLM Software does not store card numbers in its database. |
| KYC document workflow | Members can upload identity and address documents, and an administrator approves or rejects each one with a reason recorded. Verification is a human review step, not an outsourced identity check. |
| Encrypted integration credentials | Sensitive integration secrets, such as SMTP and email-provider API keys, are encrypted at rest using the application key. |
| Signed webhooks and JWT sessions | Service-to-service webhooks are verified with HMAC-SHA256 signatures. API sessions use JSON Web Tokens with token blacklisting so a token can be revoked. |
Self-hosting keeps your data in your custody
Your infrastructure, your database
The licence delivers the full Laravel source, so you can run Cloud MLM Software on your own server or cloud account. In a self-hosted deployment the database sits on infrastructure you control, which is the strongest data-custody position available: there is no third party holding your members, genealogy, wallets, or commission history.
Checkable, not just claimed
Because you hold the source code, your own engineers and security team can review how authentication, permissions, and payment handling actually work, rather than taking it on trust. See what is delivered on the source code page and the runtime stack on the server requirements page.
What we do not claim
- SOC 2, ISO 27001, or PCI-DSS certification; we will not advertise one we do not hold
- Automated identity verification or AML screening (KYC is a document upload with human review)
- Automated off-site backups
- A formal GDPR or DPDP data-export tool
If your procurement process needs a specific control or attestation, tell us before you license, and we will give you a direct answer. Have a security questionnaire? Send it over and we will answer it against the actual source.
Common questions
Yes. It supports time-based one-time password (TOTP) two-factor authentication with any authenticator app, such as Google Authenticator. An administrator can require it across the platform, and login is not completed until the code is verified.
In a self-hosted deployment, the database runs on infrastructure you control, so your members, genealogy, wallets, and commission history stay in your own custody. This is the strongest data position we can offer, and it is built into the licence: you get the full source and can host it yourself.
No. Card payments are handled by the payment gateways (Stripe, PayPal, Revolut), and card numbers are not stored in the Cloud MLM Software database.
We do not claim any of these certifications, and we will not advertise a certification we do not hold. What we do provide is a documented set of security controls in the software itself, and a self-hosted option that keeps your data in your own custody. If your procurement process needs a specific attestation, talk to us about your requirements before you license.
Verifica, poi acquista la licenza
Prova la demo dal vivo, inviaci il tuo questionario di sicurezza e controlla ogni punto nel sorgente che ricevi.