How your data is protected

Tenant isolation

Every company’s records live in a shared database behind row-level security rules. The rules are enforced by the database on every request, including requests made outside the app, so a user of one company cannot read or change another company’s rows, files or history even by calling the API directly. Files are stored in a private bucket under the same rules; downloads use short-lived signed links.

Sign-in

Accounts are email and password through Supabase Auth. New accounts must confirm their email before they can claim an invited seat. The app asks for passwords of at least 8 characters, and they are stored only as salted hashes. Password reset is by emailed link. Anyone can add two-factor sign-in with an authenticator app under Settings → Your account. Once it is on, the password alone opens no company: the database shows that sign-in none of its records, and the server refuses its changes and invoice emails, until the code from the authenticator app is entered. Sessions are tokens that expire and refresh; signing out ends the session on that device and removes the workspace copy from it. If some changes have not reached the server yet, the copy stays on the device with them, and they are sent when that person next signs in there.

Roles, checked on the server

Admin, Manager, Warehouse, Sales, Billing, Driver and Viewer roles decide what each person may change. The browser hides what a role may not do, and the server checks the same table again before applying any change, so a role cannot be escalated from the browser. Team changes (seats, roles, invitations) are admin-only; settings, history and restore are for admins and managers.

Roles decide what each person changes, and what the screens show them; they do not yet decide what reaches their browser. Every member’s browser loads the company’s whole workspace, prices and costs included: a Driver’s screens show no money and a Sales seat’s no cost, but someone who knows how could read them in their own browser. Give a seat only to people you would show your prices and costs. Sending each role only its own part of the workspace is planned.

Every change is recorded

Changes are commands applied by the server and recorded with the person, the time and the area they touched. Admins and managers can read the trail in Settings → “Who changed what”. A payment’s “Recorded by” is the signed-in person’s own name, checked by the server. Reports copied or downloaded as CSV write anything a spreadsheet would run as a formula as plain text. The last 500 versions of the workspace, none older than 180 days, are kept; admins and managers can page back through all of them under Settings → Version history and restore any one, and a restore is itself a recorded, reversible change.

Encryption and hosting

All traffic uses HTTPS. The database and file storage are encrypted at rest by the hosting provider (Supabase). The site and the server functions run on Netlify. Secrets such as database credentials and email keys exist only as server-side environment variables, never in the browser or the code repository; the browser holds only a public key whose powers are limited by the database rules above.

Backups and recovery

StockShift keeps its own version history per workspace (the last 500 versions, up to 180 days back) for quick, self-service restore, and writes a nightly copy of every workspace to separate private storage. Database backups by the hosting provider depend on the plan in force; Stackz records the plan in its deployment notes. Admins and managers can export the whole workspace as JSON at any time and import it again; Stackz loads a copy larger than 5 MB for you. Attached photos and documents are kept in storage and referenced from the records.

Email

Invoice emails are rendered and addressed by the server from the saved invoice, never from text supplied by the browser, and only by roles allowed to bill. Sending is rate-limited per company and per user. The link in an invoice email opens that one invoice, read only, for 180 days; it is signed, so it cannot be changed to open another invoice or another company’s.

Support access

Stackz staff hold a developer account that can open customer workspaces for setup and support. Its changes appear in your audit trail like anyone else’s. We do not access your workspace without a reason connected to your account.

What we do not claim

StockShift has not been through a third-party audit such as SOC 2, and we do not advertise a contractual uptime figure. We state what is in place and keep this page current as it changes.

Reporting a problem

If you find a security issue, email hello@stackz.co with the details. We will acknowledge within two business days and keep you informed.