SECURITY
An honest look at how access, data, and credentials are handled — no fabricated certifications, just what's actually true today.
Organization Isolation
Every organization's orders, photos, and records are scoped to that organization only, enforced at the database level.
Role-Based Access
Admins and warehouse employees see exactly what their role should. Warehouse employees never see company onboarding or integration settings.
Private Proof Storage
Shipment photos are stored in a private bucket and served through short-lived signed links — never a public URL.
Encrypted Third-Party Credentials
ShipStation API keys are encrypted at rest using authenticated encryption before they are ever stored.
Server-Side Integrations
Third-party credentials are only ever decrypted in server-side code. They are never sent to a browser or the mobile app.
Audit-Ready History
Every completed shipment retains a durable record of who documented it and when.
Employee Authentication
Every employee signs in with their own account — there are no shared logins.
We don't hold formal certifications such as SOC 2 or ISO today, and we won't claim we do. This page describes our actual current architecture and access-control practices.