Trust & security

Your sign-in is protected by modern session controls. Optional two-factor lets account owners require a one-time code on every login.

• Passwords hashed with bcrypt (cost factor 12)
• JWT-backed NextAuth sessions, password-change invalidation
• TOTP-based 2FA (RFC 6238) with AES-GCM-encrypted secrets at rest
• Role-based access control with module-level permission overrides

Commercial and residential workspaces are partitioned at the query layer. A session locked to one side cannot read or write the other.

• Workspace-scoped queries enforced by helpers, not optional filters
• Session contextLock checked on every inventory route — same-user accounts on both sides cannot leak across
• Employee accounts inherit their employer's data scope, never their own personal data

Data is encrypted in transit and at rest. Sensitive fields (medical notes, secrets) get an additional AES-GCM field-level layer.

• TLS for all browser ↔ server traffic
• Encryption at rest provided by the managed Postgres host
• AES-GCM application-layer encryption available for high-sensitivity columns
• Encrypted automated backups

We never store credit-card numbers. Cards are tokenized by Stripe, so PCI scope is minimized for both us and you.

• Stripe Elements + Payment Intents (no raw card data on TYS servers)
• Stripe Connect for marketplace payouts
• Webhook signatures verified end-to-end
• Idempotent recording of charges and refunds

Sensitive actions write to an immutable audit log so you can answer 'who did what, when?' without spelunking through application logs.

• Admin actions, finance actions, and permission changes logged separately
• Personal-data access events tied to actor + IP + user agent
• Account-tier changes, refunds, and overrides surfaced in the admin dashboard

Brute-force attempts, credential-stuffing, and runaway scripts are throttled before they reach your data.

• Upstash-backed sliding-window rate limiter on auth and high-cost APIs
• Brute-force lockout after repeated auth failures
• Anomaly alerts written to a security dashboard for owner review
• Leaked-key detection on stale API tokens

We ship strict HTTP security headers and a Content-Security-Policy that limits what the browser is willing to load.

• Strict-Transport-Security with preload
• X-Content-Type-Options, X-Frame-Options, Referrer-Policy
• Permissions-Policy that disables microphone and geolocation by default
• CSP allow-list for Stripe, OpenAI, and Google Analytics only

Found something? We want to hear about it before it becomes a problem. Reports go straight to the team and follow a published response window.

• Disclosure policy in SECURITY.md
• Security contact email reaches engineering directly
• Acknowledgement within 2 business days