Cartiva Business OS

Security & trust

Your store data is isolated, and Cartiva staff can't view it without your permission — every access is logged. This page lists what is in place today, in plain terms.

Tenant data isolation

Every workspace is a separate tenant. Each tenant-owned table in our PostgreSQL database carries a row-level security policy, so a query can only ever read or write rows that belong to the active tenant — enforced by the database itself, not only by application code. Platform-level tables (plans, the marketing site) hold no tenant business data.

Encryption

  • In transit: every public endpoint is served over HTTPS in production.
  • At rest: stored credentials — Shopify access tokens, courier and payment-gateway credentials and two-factor secrets — are encrypted with AES-256-GCM before they reach the database. Passwords are hashed with Argon2; session tokens are stored hashed.

Backups

A scheduled full database backup runs once a day per tenant, with retention clean-up and a tested restore path. Backups can also be triggered manually from the operations tooling.

Two-step verification

Any user can enrol an authenticator app (TOTP) and receives recovery codes. Once enabled, every sign-in — password or Google — asks for the code.

Roles and permissions

Access inside a workspace is role-based. Owners define custom roles from a catalogue of granular permissions, scope staff to specific locations, and route sensitive changes (stock transfers, manager overrides, payroll) through approvals.

Audit logs

Sign-ins, failed attempts, permission denials and integration events are recorded as security events. Platform operator actions are recorded in a separate operator audit log. Support cases keep their own history.

When Cartiva staff can access your data

Platform operators do not have a way to open your workspace or read your business records by default. Access works like this:

  1. An operator opens a support case and requests access with a written reason.
  2. Only your workspace owner or an admin (or a user you grant the approval permission) can approve, deny or revoke it. The requesting operator can never approve their own request.
  3. Access is read-only by default, limited to 60 minutes by default and 4 hours at most, and can be revoked at any time.
  4. Every request, decision, session and revocation is written to the support history and the operator audit log, and shown to you under Settings → Security → Cartiva staff access.

Responsible disclosure

If you believe you have found a security issue, email [email protected]. We acknowledge reports and keep you informed while we investigate.