Security controls described without compliance theater.

Products, attributes, imports, assets, integrations, and events are explicitly scoped to an organization. External integration entities also use organization-specific identifiers.

Stripe objects are tagged so webhook processing can reject events that do not belong to this application context.

The application runs as a non-root user in a read-only container with dropped capabilities and dedicated writable volumes. HTTPS, HSTS, Content Security Policy, iframe denial, MIME protection, and restrictive browser permissions are active.

Nightly jobs check database integrity and create AES-256-GCM encrypted backups. Restore operations do not overwrite by default and verify integrity after recovery.

Before adoption, identify the product data, supplier documents, user roles, external connections, and recovery objectives in scope. Confirm which information is commercially sensitive, who should approve changes, how access is removed, and what evidence your organization requires from a vendor.

Run a bounded evaluation with non-sensitive or representative data, review role enforcement, inspect integration permissions, test session and invitation behavior, and request current answers for any control that matters to procurement. Organizations requiring a specific certification, off-site backup arrangement, data residency commitment, or contractual security term should resolve that requirement before production use.