Your shop data, locked down by default.

TLS 1.2+ for every request. Data in our Postgres cluster is encrypted at rest by the storage layer (AES-256). Secrets — API keys, webhook signing, OAuth tokens — are stored via platform-managed key material, not in application code.

Every tenant-scoped row carries a `tenantId`. Every request runs through a server-side gate that resolves the tenant from the URL, checks membership, and attaches it to the query. Two tenants cannot read each other's data by any URL, API, or mistake.

Owners, admins, managers, sales, designers, installers, accountants, and employees each have an explicit permission set. Every server action and every UI button gates on the same capability check — no hidden escalation paths.

Managed Postgres on a provider with automated daily backups and point-in-time recovery. A production incident that corrupts your data can be restored to a timestamp, not a 'last night's backup' hand-wave.

Sign-ins, permission changes, record deletions, impersonation sessions — all logged to an append-only audit stream. Owners can review the last 90 days of activity from the settings panel.

TOTP-based 2FA is available for every user, and owners can require it for every member of their workspace. Recovery codes are one-time-use and rotate on use.

When our support staff need to view your workspace, they do so via an audited impersonation session — banner displayed to the customer, every action logged against the support agent's platform account, not yours.

Every tenant can export their complete data set (customers, quotes, orders, invoices, files) as structured JSON at any time. No lock-in. No data-held-hostage if you leave.