Security Best Practices

Crystal Reports built against Sage X3 inherit the same data-sensitivity as the ERP itself; see the main site's User Security & SoD page for the broader compliance picture.

Role-based access

Report access should follow the same role structure as Sage X3 itself. A user shouldn't see report data they couldn't otherwise access in the ERP.

Company and site filtering

Every report should filter by company/site parameters rather than pulling unfiltered data and relying on the user to interpret it correctly.

Audit logging

Track who ran which report and when, especially for financial or compliance-sensitive reports.

Avoid hardcoded credentials

Report data connections should use managed service accounts, never a hardcoded username/password inside the report file itself.