Security

Where it lives

• The database is Postgres on Supabase in the EU (Ireland), encrypted at rest, with daily backups. The app runs on Vercel and talks to it over TLS.
• Everything between your browser and the app is encrypted in transit. There is no unencrypted route.
• Card details go straight to Stripe from its checkout page. We never receive, see or store a card number.

Signing in

• No passwords. A sign-in link is emailed to you, works once, and expires in twenty minutes. Only the hash of the link's token is stored.
• Sessions are random ids in a cookie that scripts on a page cannot read, and expire after thirty days or when you sign out.
• Your private logging address is a random token on our domain; rotate it from your account at any time and the old one stops working.

Who can see what

• Your pipeline, notes, drafts and pack are visible only to your account. Shop data from the registers is shared by every account, because it is public.
• Our own access is limited to the founder, for support and for the concierge review of packs described on the landing, and every access is logged by the database.
• Processors (named in the privacy notice) receive only what their job needs: OpenAI receives the text of your site and the facts a draft needs, never your contacts list; Reoon receives one email address at a time.

What we cannot promise

We are a small company. We do not hold a SOC 2 or ISO 27001 certificate, and we will not claim one until we do. What we can say is that the stack is standard, the surface is small, secrets are kept out of the code, and the list above is true.

Reporting a problem

If you find a security fault, email hello@getstockists.com with the subject "Security". We reply within two working days, fix what is real, and credit you if you want to be credited. Please do not test against other customers' data.