Security overview

01Hosting

The database and sign-in run on Supabase in one data-center region. The website is served by Cloudflare. Both providers publish independent SOC 2 Type II reports.

02Encryption

All traffic uses HTTPS (TLS). Data is encrypted at rest by our database provider.

03Access control

• Every request is checked by row-level security rules in the database, not by hiding buttons in the page.
• Each person has their own login and one of five roles: admin, editor, supervisor, viewer or staff.
• Admins can limit roles to the office network or to one device, and can sign a person out everywhere.
• Read-only roles cannot change data, even by calling the server directly.

04Audit trail

Order checks, approvals and status changes are written to append-only logs that nobody can edit afterwards.

05AI features

For Photo scan, the photo is sent to our AI provider only to name the product. The provider never sees your catalog, prices or stock, and we do not store the photo.

06Our staff

Only our admin can reach customer workspaces, using a personal login with its own role. We do so only to give support you ask for, or when the law requires.

07Service providers

We tell account owners before we add a new provider that handles their data.

08Certifications

We are not certified for SOC 2 or ISO 27001. We will update this page if that changes.

09Report a problem

If you find a security issue, email contact@atriumcommerce.com. We reply within 2 working days and will not take action against good-faith research.