Account security
Platform authentication via Supabase Auth with server-side session validation.
Company
Security
Security is a product requirement. We describe controls in plain language — without claiming certifications we do not hold.
Core controls
Authorization
Centralized server checks combine membership, store scope, and action. Deny by default.
Tenant isolation
Sensitive reads/writes derive trusted store context — never trust client store IDs alone.
API security
Versioned endpoints, schema validation, scoped API keys, rate limits, request IDs.
Webhook verification
Verify signatures and timestamps before accepting business events.
Private digital files
Objects stay private; downloads use authorized short-lived signed URLs.
Financial ledger
Balances and fees use integer minor units with transactional posting.
Auditability
Sensitive actions record actor, target, and outcome without secret payloads.
What we do not claim
We do not advertise SOC/ISO certifications, regulated custody licenses, or uptime guarantees unless separately published. Exact compliance programs remain out of scope until explicitly adopted.
FAQ
Can Store A access Store B by guessing IDs?
Sensitive cross-tenant access should return denial or non-disclosing not-found responses.
Are client prices trusted?
No. Checkout recalculates from the database.
Build on a serious foundation
Start a store with tenant isolation from day one.