Security engineered into the foundation, not bolted on.
We protect merchant customer data, financial transactions, and catalog assets with defense-in-depth security controls and PostgreSQL Row-Level Security.
Comprehensive platform security pillars
PostgreSQL Row-Level Security (RLS)
Every shop table carries the shop it belongs to, every query is scoped to that shop, and each table has a PostgreSQL Row-Level Security policy that denies access when no shop is set.
AES-256 Data Encryption
Sensitive credentials—including Meta CAPI access tokens, courier API keys, and payment secrets—are encrypted using AES-256-GCM before hitting disk and are never exposed in logs or frontend responses.
Two-Factor Authentication & Staff Roles
Protect your dashboard with two-step sign-in, using an authenticator app (TOTP) or a code sent by email, with recovery codes. Passwords are hashed with Argon2id. Assign strict role-based permissions to staff members (e.g. Order Dispatcher, Catalog Editor).
Managed Hosting, SSL & Updates
There is no server for you to patch. Hosting, security fixes and new features are shipped by the platform to every shop at once, and SSL certificates for your own domain are issued and renewed automatically.
Rate Limiting
Redis-backed rate limits on sign-in, one-time codes and the storefront slow down password guessing, credential stuffing and request floods.
Comprehensive Audit Trail
Administrative changes, price edits, staff role assignments and order actions are written to an audit log, kept for a year by default.
Responsible Security Disclosure
We take security vulnerabilities seriously and welcome responsible disclosure from security researchers. If you discover a potential vulnerability, please email our security team directly.
[email protected]