Your whole business lives here. Here’s how it’s protected.

What’s protected today

• Your yard is a sealed box

  Every record belongs to exactly one yard, and the isolation is enforced at the database level — not just hidden on screen. The backend refuses to return one yard's data to another yard's user. Many yards share one platform; none can see another's.

• Sensitive operations are protected

  The operations that move money and stock — reserving blocks, cutting, applying credit, processing returns, provisioning a worker login — run as protected server-side functions that a browser can't bypass or tamper with.

• Least-privilege by role

  Workers see their own tasks, cuts, and pay — never prices, margins, customers, or another worker's data. Drivers see only their own deliveries. The public sees only the safe, available-stock details a yard chooses to publish.

• Narrow public surfaces

  The showroom, a block's QR card, and delivery tracking are the only public windows, and each reads a deliberately narrow, safe set of columns — never cost, supplier, exact location, or any financial data.

• A managed, durable backend

  Data lives in a managed cloud with automated durability — there are no local files to lose. Credentials are never hard-coded in the app.

• Your data is portable

  Everything exports to Excel and CSV at any time. Your data is yours; there's no lock-in holding it hostage.

What we’re still finishing

• Complete audit-trail loggingIn progress

  An activity view exists today; automatic, tamper-evident server-side logging of every sensitive action is still being completed. We'd rather tell you it's in progress than imply a complete forensic trail exists now.

• Isolation & permission hardeningIn progress

  The multi-tenant model is enforced at the data layer, with several hardening passes already done and a few follow-ups tracked before large-scale rollout — including a formal third-party review.

What we don’t claim

We won’t dress up our security with badges we haven’t earned. We make no claim to any formal certification or compliance audit we haven’t actually completed, and we won’t use phrases like “bank-grade” as decoration. When we achieve a certification or complete a formal review, we’ll say so plainly here — with the evidence.

Found a problem? Tell us.

If you believe you’ve found a security issue, we want to hear from you before anyone else does. Please report it privately and give us a reasonable chance to fix it before disclosing publicly — we commit to acknowledging genuine reports and keeping you updated.

A dedicated security contact address is being set up. In the meantime, reach us through the contact page and mark your message as a security report.