SECURITY AND DATA
WHERE YOUR DATA LIVES AND HOW
Production data is a shop's most sensitive information: what you make for whom, at what price, with how much scrap. What follows is not marketing copy; it is in the code and covered by tests.
Companies cannot see each other, and not because the app code behaves
Each company's data is separated at the database level (row level security). The role the application connects with cannot bypass that separation; if it could, the server refuses to start. So even a bug in the code cannot show one company's data to another.
Backups are taken, and we regularly prove they restore
The database and your uploaded files are backed up daily. Here is the point: a backup you have never restored is not a backup. Data loss usually happens not because no backup was taken, but because the backup turned out to be corrupt and nobody found out until the disaster. We restore ours regularly, and that drill is part of the test suite.
Two-step verification
Accounts can be protected with an authenticator app on your phone. Recovery codes are issued in case you lose it. Passwords are stored irreversibly; we cannot read them either.
Who changed what, and when
Changes to records are written to an audit trail. When a number is disputed, the question of who changed it and when has an answer.
Your card details never reach us
Payments are handled by Paddle. Your card number never touches our servers and is not stored by us.
The data is yours and you can take it
You can export your records as tables. Turn a module off and its records are not deleted; they stay readable. If you leave, you keep your data.
WHAT WE ARE NOT CLAIMING
Security pages usually list only the good news. Here is what we do not have yet:
- We hold no ISO 27001 or SOC 2 certificate. Those require independent audits and we are a new product.
- No independent penetration test has been carried out yet.
- Backups currently sit on the same machine as the server. Copying them off-site is on the list.
- We do not offer a service level agreement; we cannot promise there will be no outage.
If you notice a security problem
Write to us. We take reports seriously, we reply, and we announce the fix.
Contact