Security and data
What we have built to protect your business's data and your buyers' details. Everything listed here is how the software works today, not a plan.
-
A wall around each business, in the database
Every record a business owns is tagged with that business, and the database itself (PostgreSQL row-level security) only shows a request the records of the business it is working for. The application signs in to the database as a role that cannot bypass those walls, so a mistake in our code can't show one seller's data to another.
-
Channel access tokens are encrypted
When you connect a store, its access token is stored encrypted with AES-256-GCM and bound to that one connection, so a copied token can't be used anywhere else. Tokens never appear on screen or in logs. Disconnecting a store deletes its token.
-
Buyers' contact details only for the roles that need them
Everyone on a business's team sees a buyer's name, city and state, which they need to work an order. The street address, postcode, phone and email are shown only to roles allowed to see contact details, and on packing slips and labels to the people who ship. Each business decides which of its roles have that permission.
-
An audit log of every change
Every change, by a person or an agent, is written to an append-only log in the same database transaction as the change itself, so nothing changes without a record of who did it and when. You read it as Activity, in plain words, and can download it. Buyers' contact details are never written into it.
-
Agents propose, people approve
Our AI agents work through the same permissions, approval rules and audit log as people; there is no back door. They propose changes, such as a reorder or a price fix, and a person approves them. You choose which kinds of change need approval and who approves. Every agent run is recorded step by step, with its cost, under a monthly spending cap per business.
-
AI models never get buyers' contact details
The tools our agents use give the AI model only what the task needs: products, stock, prices, order lines and totals. They leave out buyers' names, addresses, phones and emails. We use Anthropic's Claude through its commercial API.
-
Forgetting a buyer, and Shopify's privacy requests
A seller can forget a customer, which erases their name and contact details from the customer record and their orders while keeping anonymous totals. Shopify's privacy requests are answered automatically: a data request is recorded for the seller, a customer erasure forgets that customer, and a store erasure deletes what we kept about the store. Tax invoices are kept as issued, because the law requires them.
-
Logs hold no seller or buyer data
Our server logs record the shape of each request (which page, the result, how long it took) and error types. Products, prices, customers, tokens and AI prompts are never logged, and anything that slips through under a common field name is blanked before it is written.
-
Sign-in
Passwords are stored only as salted scrypt hashes. Sessions use a random token in a secure, HTTP-only cookie, and we store only a hash of it. Repeated failed sign-ins lock the account for 15 minutes. Removing someone from a business ends their sessions there at once.
-
Encrypted in transit and at rest
The application and this website are served only over HTTPS. The database runs on Neon, which encrypts stored data at rest; the application runs on Render, in the United States.
Report a security problem
If you think you have found a security problem, or that data has been exposed, email hello@smargent.app with what you found. Please don't access other people's data to show it. We reply as soon as we can and keep you told what we do about it.
For how we use and keep personal data, read the privacy policy.