Account and Security

A user account is essential for securing your business data and controlling access to your MAQSU ERP system. Each user account is associated with a unique set of permissions and roles, which define the modules and features that a user can access.

A user account is created by an administrator and is linked to the user's email address. Each user is required to have a unique email address to receive notifications and reset their password if needed. The user account page provides an overview of the user's profile information, including their name, email address, and assigned roles. Users can update their profile information, reset their password, or change their assigned roles as necessary.

Account Security

This section provides an overview of user account management and security features in MAQSU ERP. Topics covered include:

• User account creation and management
• Profile information and role assignment
• Advanced login security features
• Password policies and enforcement
• Strong password requirements and rotation

---

Login Security

MAQSU ERP provides advanced login security features to ensure that only authorized users can access the system. 

Key features:

1. Email & Password login: Users can log in using their email address and a unique password.
   
2. Password policies: Administrators can configure password policies to enforce strong password requirements, such as password length, complexity, and rotation.
   
3. Session control (auto logout after inactivity): The system can be configured to automatically log out users after a specified period of inactivity to prevent unauthorized access.
   
4. Admin-only user creation: Only administrators can create new user accounts to ensure that access is properly controlled and audited.
   
5. Two-factor authentication (2FA): MAQSU ERP supports two-factor authentication to provide an additional layer of security for users. This can be configured to require a second form of verification (e.g., code sent via SMS) in addition to the user's password.

---

Reset Password

Password reset is a straightforward process in MAQSU. This guide outlines the steps to follow in order to reset a user's password. Please follow the method that best fits your situation.

To reset a user's password, follow these steps:

Step 1 — Navigation

From the main dashboard, navigate to Settings by clicking on the gear icon at the top-right corner of the page. Then, from the dropdown menu, select User & Companies and click on Users from the sub-menu.

Step 2 — Change Password

Select the user whose password you want to reset and click Change Password. The Change Password button will open a password reset form where you can enter a new password for the selected user. Make sure to enter a strong password that meets the password policy requirements.

Step 3 — Enter a new password

Enter a strong and unique password for the selected user, making sure it meets the password policy requirements (e.g., minimum length, complexity, and rotation period). Then, click Change Password to save the new password.

Users and Permissions

Users and permissions are core components of MAQSU's security system. The system is designed to be secure, scalable, and customizable to meet the needs of various businesses. The user and permission system is based on a Role-Based Access Control
(RBAC) model, which allows administrators to define roles and assign them to users. Roles are used to define the actions that a user can perform within the system.

Roles

This is the Roles management page, where administrators can create and manage user roles within the system. Roles are used to define a specific set of access rules and permissions that can be assigned to one or more users, helping control what each user can see and do inside the system.

Here's the typical step-by-step:

Step 1 — Navigation

Navigate to Settings by clicking on the gear icon at the top-right corner of the page.Then, from the dropdown menu, select Users & Companies and click on Roles from the sub-menu.

The list displays one role record with the following details across each column.

The Name column shows SCT, which is the name of the role. This is the identifier used when assigning the role to users or referencing it in access configurations.

1. The Created by column shows Administrator, meaning this role was created by the system administrator account.
2. The Created on column shows 14/03/2026 12:19:23, which is the exact date and time the role was first created in the system.
3. The Users column displays a tag labeled SCT, indicating that there is currently one user with the username SCT assigned to this role.
4. The Access Rules column shows the number 3, meaning this role has three access rules configured, which define what resources or actions users under this role are permitted to perform.
5. The Active column displays a toggle switch that is turned on (shown in dark blue), confirming that this role is currently active and in use within the system. Toggling it off would deactivate the role without deleting it.

Step 2 — Create New

Click the Create button to create a new role. This will open a blank role form where you can enter the role name and description.

Step 3 — Enter role name or describe your role

Assigning a descriptive name to a role makes it easier to understand the purpose of the role and facilitates better management of user permissions.

Step 4 — Assign users to this role

This section enables you to assign users to this role, inheriting all access rules configured below.

• Add the employees who should have "Accountant" permissions, such as accountants, bookkeepers, and other financial professionals.
• Any user added here will automatically inherit all access rules below, ensuring that only authorized personnel can access sensitive financial information.

Access Rights

Access Rights is the core permission system in MAQSU that controls what each user can see and do within the system. By configuring access rights inside a role, administrators can precisely define which data models a user can interact with and what level of interaction is allowed.

Access rights are assigned at the Role level, not directly to individual users. Once a role is configured with the appropriate permissions, any user assigned to that role will inherit those access rules automatically. This makes it easy to manage permissions for groups of users consistently.

For example, an Accountant role would be given access only to accounting-related models, a Sales role would have access limited to sales and CRM data, and an Admin role would have full control across all modules in the system. If a user's role does not include access to a specific module or model, that user will not be able to open or interact with it at all.

Inside each role's configuration form, the Access tab (highlighted in the screenshot) is where data-level permissions are defined. Each row in the access table represents a specific data model and its allowed operations. The columns are as follows:
The access rules are defined as follows:

1. Model Description: The specific data model the rule applies to, such as Sales Order.
2. Model Category: The broader module the model is grouped under, such as Sales and CRMs.
3. Filter: Restricts which specific records within that model the user can access. For example, a filter rule for a Sales Order model could limit access to only orders from a specific region, customer, or date range.
4. Read: The user can view records of this model.
5. Create: The user can add new records of this model.
6. Write: The user can edit existing records of this model.
7. Delete: The user can remove records of this model.

To add a new access rule to a role, click Add a line (highlighted in the screenshot) to insert a single rule, or Add multi-line to add several rules at once. After adding a line, select the target model and check the appropriate permission boxes based on what the role should be allowed to do.

Restriction Access

Based on the screenshot, here is the explanation focusing on all three restriction tabs — Hide Menu, Hide Action, and Hide Button/Tab — highlighted in the Roles / Accountant configuration:

Beyond data-level permissions set in the Access tab, MAQSU provides three additional tabs that give administrators fine-grained control over what users can see and interact with in the interface. These three tabs — Hide Menu, Hide Action, and Hide Button/Tab — work together to create a fully restricted and role-appropriate experience for each user.

1. Hide Menu

The Hide Menu tab controls which top-level navigation menus are hidden from users assigned to this role.

In this example, the Accountant role has four menus configured to be hidden — Sales, Purchase, Inventory, and Settings. This means users with the Accountant role will only see the modules not included in this list when they log in, preventing them from navigating to unrelated areas of the system entirely. Each entry has a drag handle on the left for reordering and an × button on the right to remove it from the hidden list. The Add a line option at the bottom allows adding more menus to restrict.

2. Hide Action

The Hide Action tab takes restriction a step further by hiding specific action buttons or options that appear within a module's interface. Even if a user can access a module through the menu, certain actions — such as confirming an order, validating a delivery, or printing a report — can be hidden so the user cannot perform those operations. This is useful when a user should be able to view a module but should not be able to trigger certain workflows or processes within it.

This page configures the Accountant role's access control for Journal Entries under Accounting. The screenshot shows the following settings:

• Role: Accountant
• Users: SCT is assigned to this role
• Access Rules: 5 rules attached to the role
• Open tab: Hide Action
• Model: Journal Entries under Accounting

To restrict what accountants can do in the Journal Entries module:

1. Hide the New Invoice1 and Invoice 01 reports from the accountant.
2. Prevent the accountant from posting entries, reversing them, or sending and printing them.
3. Hide the Graph, Pivot, Calendar, Diagram, Gantt, Activity, and Grid views from the accountant.

To restrict an accountant from modifying journal entries, you would typically:

1. Tick Hide Create
2. Tick Hide Edit
3. Tick Hide Delete
4. Tick Hide Export if needed
5. Click Save

This page controls what accountants can see or do in the Journal Entries module, ensuring that they can only view and interact with the data as intended by the system administrator.

3. Hide Button/Tab

This page controls the visibility of specific actions and tabs within the Journal Entries module, for users assigned to the Accountant role.

The available buttons that can be hidden are:

• Post (action_post): this button is used to post a new journal entry after filling in all required fields.
• Add Payment (action_invoice_register_payment): this button is used to register a payment for a customer invoice.
• Capture Transaction (payment_action_capture): this button is used to capture and confirm a payment transaction.
• Void Transaction (payment_action_void): this button is used to cancel a payment transaction.
• Add Credit Note (action_reverse): this button is used to add a credit note to a customer invoice.
• Duplicate (action_duplicate): this button is used to duplicate an existing journal entry.
• Cancel Entry (button_cancel): this button is used to cancel an existing journal entry.

The available tabs/pages that can be hidden are:

• Invoice Lines: this tab is used to view all the lines of a customer invoice.
• Journal Items: this tab is used to view all the journal entries of a customer invoice.
• Valuations: this tab is used to view all the valuation entries of a customer invoice.
• Other Info: this tab is used to view all the other information of a customer invoice.

By selecting specific buttons or tabs here and saving, those items will be hidden from users in the Accountant role.

For example, if you want to restrict accountants from posting, duplicating, or seeing Other Info, simply select the corresponding items and save.