Security
Security and data isolation are requirements, not optional refinements.
Tenant isolation
Every record is scoped to your business. Your orders, customers, and data are never visible to other businesses on the platform - enforced at both application and database level.
Encrypted data at rest
Your data is encrypted in transit (TLS) and at rest, with sensitive values protected by an additional layer of strong encryption.
Secure sessions
HTTP-only, SameSite cookies with session rotation and revocation on password change. Rate-limited authentication to prevent brute force and credential stuffing.
Customer privacy
Customer tracking links reveal only safe order information. Internal notes, costs, and staff details are never exposed. Tracking pages are excluded from search indexing.
Server-side validation
Prices, discounts, and totals are always recalculated on the server from the database. Browser-submitted values are never trusted.
Full audit trail
Every security-relevant action - payments, refunds, cancellations, inventory adjustments, exports, and admin actions - is recorded in an append-only audit log.