What we promise.
In plain language, before the technical detail.
Your inventory, invoices, customers, and payments are visible only to people you’ve invited to your branch. Not to us, not to other GwizaSuite customers, not to anyone else.
Who edited that invoice. When. From which device. We log every write to your data and keep those logs for the life of your account — exactly what the RRA asks for in an audit.
If you cancel, we export everything to CSV within 7 days and delete your account within 30 days. No lock-in. No hostage data.
A storekeeper can’t edit the ledger. A salesperson can’t close a period. Seven role types, each scoped to what they actually do.
Automatic encrypted backups every 24 hours. 30 days of point-in-time recovery. If something breaks, we can restore your books to any point in the last month.
How it works under the hood.
For IT teams, accountants, and anyone doing the diligence.
Every table, every row, scoped to a branch.
GwizaSuite runs on PostgreSQL with Row-Level Security (RLS) policies on every table that holds customer data. Every row carries a branch_id. Every query — whether from the staff dashboard, the customer portal, or a direct database connection — is filtered against the authenticated user’s branch_id at the database level.
- Enforced in the database, not the application layer
- Cannot be bypassed by a bug in our code
- Verified by automated test suite on every deploy
- Audited by external reviewer each quarter
-- Simplified RLS policy on the invoices table CREATE POLICY "branch_isolation" ON invoices FOR ALL USING (branch_id = ( SELECT branch_id FROM users WHERE id = auth.uid() ));
Built for the RRA. Not retrofitted.
Most accounting tools treat Rwandan tax compliance as an afterthought. We treat it as the foundation. Your GwizaSuite account is audit-ready from day one.
- 18% VAT automatically calculated and tracked per invoice
- VAT return summaries exportable in RRA-accepted formats
- 7-year retention on all financial records, per RRA requirement
- EBM (Electronic Billing Machine) integration roadmap published
- Quarterly compliance review with a Rwandan-licensed accountant
- Periods lock on close — auditors see a frozen, tamper-evident ledger
When something goes wrong, here’s what we do.
No system is invulnerable. The question is how you respond.
Automated alerts on unusual access patterns, failed logins, database anomalies. On-call engineer paged within 5 minutes.
Affected systems isolated. Root cause analysis within 24 hours. Forensic trail preserved via audit log.
If your data was affected, we email every affected account owner within 72 hours. Full post-mortem published within 14 days, regardless of severity.
Security FAQ.
The questions procurement teams and accountants actually ask.