Easy Soft Edit

The CMS with a built-in encrypted database

Security

Security by design: encrypted data on your hosting, access closed by default, SQL injection protection.

Easy Soft Edit’s security comes from design choices: few exposed parts, encrypted data on your own hosting, rights closed by default.

Built-in database engine

No SQL server to reach, so no SQL query to hijack: the engine is part of the CMS.

Encrypted tables

Data is encrypted on your hosting’s disk. The key is never stored with it; it can even be placed outside the site folder.

No data in the cloud

Content, accounts and messages stay on your hosting, in the country you chose. No third-party service hosts them.

Access closed by default

Every administration screen has its own right. Nothing is open until you grant it; sensitive rights are reserved for super administrators.

Signed updates

Every update package carries a digital signature checked before installation, with backup and rollback.

See the features →

Protected forms

Anti-forgery token, bot trap, minimum delay and per-address submission limit: public forms resist automated abuse.

SQL injection protection

No SQL server: no SQL entry point

An SQL injection slips instructions into a field or an address so that the database server runs them. It assumes an SQL server interpreting text.

A classic CMS

  • Builds SQL queries from what the visitor types
  • Relies on a database server exposed on the hosting
  • Depends on the care taken by each extension

Easy Soft Edit

  • No SQL query: the built-in engine reads and writes data through CMS functions
  • No database server to attack
  • Identifiers received in an address are checked before any use

And a second line of defence

  1. Detection. Incoming addresses are analysed: common SQL injection patterns (union select, drop table, information_schema…) are spotted and logged.
  2. Banning. After three attempts the IP address is banned automatically. Trusted addresses can be allow-listed.
  3. Follow-up. An administration page lists banned addresses and detected attempts, and lets you lift a ban.

Accounts, access and data

Accounts

Passwords stored as a hash (never in clear), code-based two-factor authentication, temporary lock after repeated failures, sign-out after inactivity.

Traceability

Connection log, administration action tracking, history of password and login changes.

Privacy

Data minimisation, recorded consent, permanent erasure, reversible recycle bin, fair cookie banner.

See the cookie policy →

Pages, files and backups

Content

Everything displayed is escaped: text typed by a visitor cannot become code executed in someone else’s page.

Uploaded files

File types are checked, executables and scripts refused, attachments stored in folders the server never serves directly.

Backups

Built-in, schedulable backup with restore. The site is backed up before each update.

No software is invulnerable. Security also depends on up-to-date hosting, strong passwords and verified backups. For a sensitive project, an audit of your configuration is possible.

A security question about your project?

Describe your context (data handled, hosting, obligations) and we will answer precisely.

Request a quote See the features

Also worth exploring