Draft
This page is a draft, not yet reviewed. It says what the product does today and marks plans as plans.
Inventory software security
Where your data is held, and who can reach it.
Your records are held in EU (Ireland). Each workspace sees only its own records.
Inventory data hosting
Your records are held in EU (Ireland).
The database runs in that region. Your logo, the one file we store, is kept in it too.
Data encryption
Encrypted in transit and at rest.
Connections to the site, the app and the API use HTTPS. The database host encrypts stored data at rest.
API key security
Keys are shown once and stored as a hash.
Each workspace makes its own API keys. A key reaches only its own workspace.
- Shown once
- The full key is shown once, when you create it.
- Hashed at rest
- Only a SHA-256 hash of the key is stored, with its last four characters for display.
- Read only or read and write
- You choose the scope of each key when you create it.
- Logged
- Every write made with a key is recorded in the integration activity log.
- Revoked at once
- A revoked key gets a 401 on its next request.
Access control
Each workspace sees only its own records.
Every record belongs to one workspace, and every request is checked against it.
- Sign-in by email link
- Users sign in with a one-time link sent to their email, so no password is stored.
- Roles
- An owner gives each user a role: owner, manager or warehouse.
- Removing users
- An owner can remove a user, who loses access on their next request.
- B2B portal
- Each trade customer sees only their own prices, stock and orders.
Database backups
Daily backups and a tested restore, planned before the first customer's data.
Today we run no backup schedule of our own, and no restore has been tested. Before the first customer's data is stored, the database moves to a paid plan with daily backups and a tested restore.
Every list exports to CSV, and a full workspace export is in settings on every plan.
Sub-processors
Four services handle your data.
Each one handles only the data its job needs. Intuit joins the list when the QuickBooks Online sync is released.
| Service | What it does | Data it handles |
|---|---|---|
| Supabase | Database | Your records, held in EU (Ireland) |
| Vercel | Hosting the website and the app | Page requests and server logs |
| Resend | Sign-in and notification email | Email addresses and message content |
| Stripe | Card payments and billing | Billing details; card numbers are typed on Stripe's own page |
Security pack
Ask for the security pack, or report a security issue.
Use the contact form and say it is about security. The pack covers data handling, access control, backups, sub-processors and incident response.