Cha-ChingSecurity
Your customer list is the asset. Here is exactly who can touch it.
A marketplace puts competitors on one database. If that wall is a convention rather than a mechanism, somebody's phone numbers end up somewhere they should not be. This page is specific because it has to be.
The access rule
Two conditions, and both must hold
Membership has two independent dimensions, and the common mistake is to check only one. A user belongs to a seller, or to a call centre. A call centre is assigned specific shops. An agent inside that centre is separately cleared for a subset of those shops.
An agent may read an order only if their centre is assigned that shop and they are cleared for it. Checking just the first leaks every client of the centre to every agent in it. Checking just the second leaks across centres entirely.
Platform staff
See everything, and every look that changes something is written down against their name. Read-only roles exist and are genuinely read-only.
Seller users
Their own shops, their own orders, their own ledger. Optionally narrowed further to specific shops for a member of their team.
Centre managers
The clients they are contracted to, and their own floor. Not other centres’ clients, and not the seller’s billing.
Centre agents
Only shops they have been cleared for, by their own manager. Two agents at one centre working different clients cannot see each other’s orders.
It is enforced in the query layer, on every read, rather than by hiding screens — and every build runs the test suite as all four of those principals against anything that touches an order. A permission model nobody tests is a permission model that has already drifted.
The money
Append-only, held by the database and not by good intentions
Every commission event writes one row carrying the rate that applied at that instant. A trigger in the database refuses UPDATE and DELETE on those rows — the single exception being the field that attaches a row to a payout.
That is deliberately stricter than an application check. Application checks are bypassed by the next migration script somebody runs at midnight; a trigger is not. And nothing is ever recomputed from orders, because published prices change and recomputation silently rewrites history.
The rest of it
The unglamorous parts, listed
The access token for your Shopify or WooCommerce store is encrypted with AES-256-GCM before it is stored, and is never selected into any page, any export or any log line.
Password hashes, encrypted tokens, webhook secrets and API secrets are on a deny list that the generic data browser enforces structurally — not a field somebody remembered to hide.
Order status, assignment, profile edit, payout approval, price change — written in the same transaction as the change itself, so a change cannot exist without its record.
Shopify by app secret, WooCommerce by a per-shop secret selected from the path. Nothing is trusted because it arrived at the right URL.
Repeated wrong passwords for one address lock that address for a window. A throttled attempt is indistinguishable from a wrong one, on purpose.
Nonce-based, no inline script, no third-party origins. The marketing site you are reading loads nothing from anywhere else either.
Being straight about it
What we do not claim
Security pages that list only strengths are the ones worth distrusting. So, plainly:
- We are not certified. No SOC 2, no ISO 27001. Those are real processes with real audits and we have not been through them. If you need one, say so before you apply rather than after.
- There is no row-level security in the database. The access rule lives in the application's query layer. That is a deliberate trade — it is where the two-dimensional rule can actually be expressed — and the mitigation is that it is tested as all four principals on every build.
- We can read your data. Platform staff can, by design, because somebody has to referee disputes between a seller and a centre. Every such look that changes anything is logged against a named person.
Found something? Write to us before you write about it, and we will tell you what we did and when. Contact · Privacy policy · Data processing
Questions a security review would ask?
Send them. We would rather answer them now than discover a mismatch after you have connected a shop.