Security overview
Tenancy isolation, encryption in transit and how access is enforced.
Tenancy
Every record belongs to a company, and requests are scoped to the caller's company. Store-level access is enforced on top of that: staff assigned to one shop cannot read another shop's takings, tills or repair tickets. Owners and admins reach every shop.
Three independent gates
- Role permissions — twenty of them checked on the server; the rest shape the interface, or are already covered by a stricter admin-only rule on the route. See Roles and permissions
- Store assignment — enforced on reads as well as writes
- PIN approval — required at the moment certain actions happen
Secrets
Passwords and PINs are stored hashed. SMTP passwords and provider API keys are never returned when settings are read — they can be replaced, not retrieved. The AI query engine is explicitly barred from selecting password hashes, PIN hashes and payment-provider identifiers.
Cross-site protection
Changing requests require a header that a cross-site form cannot set, and campaign HTML is stripped of executable content both when saved and when displayed.