What we protect and how
Every statement below reflects what the platform actually does today. Where a control is partial, we say so plainly.
Encryption & Storage
Passwords stored as bcrypt hashes, never in plaintext. MFA tokens and backup codes stored hashed. Card details go directly to Stripe and never touch our systems.
Role-Based Access Control
Server-side permission enforcement across 15 permission groups and 2 product domains. Custom roles, cross-org isolation, and a closed fail-mode denied by default.
Multi-Factor Authentication
Email-based OTP with hashed backup codes. Opt-in by default, with org-wide MFA policy available. Re-authentication required for sensitive changes.
Incident & Event Logging
Dedicated security event log covering failed logins, brute-force patterns, forced logouts, MFA failures, and account suspensions. Real-time engineering alerting.
Infrastructure & Backups
Hosted on DigitalOcean with daily automated backups. Backup files are not web-accessible. Zero-downtime deployments via Laravel Envoyer.
Code & Deployment
All changes via version control with pull request reviews. Built on a maintained Laravel release with PHP 8.2. Lockfile-managed, reproducible dependencies.
Session & credential security
OAuth 2.0 bearer tokens validated server-side. Revocation is instant, no waiting for client timers.
Brute-force protection
Login throttled per email + IP. Repeated failed attempts trigger automatic account lockout. Every failed attempt is logged with escalating alerts to the security team.
Immediate token revocation
Logout revokes the current token. Force logout revokes all tokens. Suspension revokes all tokens and blocks new logins effective on the next request.
Short-lived credentials
All security-sensitive tokens — MFA passcodes, challenge tokens, password resets, email verifications, and invitation links — are strictly time-limited and automatically expire. Passcode resend requests are rate-limited to prevent abuse.
Organization & access control
Customer organizations administer themselves. Permissions enforced in three layers: interface visibility, client route guards, and authoritative server-side middleware.
Admin controls
Seamless Source does not need to be in the loop to add, remove, or restrict a user.
Permission matrix
Server-side enforcement across 15 permission groups and 2 product domains.
New custom roles start restricted. External/public roles are forced to hide on all internal sections.
Subprocessors
Every third party that processes customer data on our behalf, derived from the platform's actual service configuration.
Core Infrastructure & Platform
Product Functionality
AI Subprocessors
Operational & Monitoring
Customer-authorised integrations (not subprocessors)
Shopify - Two-way product/catalogue sync with your own store, via OAuth you authorise and can revoke.
Support & issue reporting
Built-in support chat, structured bug reporting, and automatic error capture designed for transparency.
In-app support chat
Messages and attachments stored on a non-public disk. AI assistant responds if no human reply within 60 minutes. Conversation history retained and reopenable.
Structured bug reports
Screenshot auto-capture (reviewable before sending), severity levels, tracked status lifecycle. Auth headers stripped, request bodies truncated at 5,000 chars.
Automatic error capture
Unhandled errors submitted silently with sanitisation. Deduplicated within 5-minute windows. Unauthenticated endpoint ensures expired-session errors are still captured.
Password policy & compliance
How we enforce credential security and track compliance readiness across the platform.
Password policy
Compliance readiness
A built-in compliance readiness dashboard continuously re-runs technical checks against the live codebase:
Each check reports as met, partial, or not met a regression surfaces as a failed check rather than going unnoticed.
Need a security review?
Contact us directly and we will complete your security questionnaire. We believe in honest, defensible answers.
Contact Security TeamFrequently asked questions
How is access to systems managed?
Access is governed by role-based access control enforced server-side by dedicated permission gates and route middleware on every protected endpoint. Organization administrators have a security console to manage users directly: suspend/reactivate accounts, force logout, force password reset, and manage MFA.
How are security incidents handled?
Security-relevant events are recorded to a dedicated security event log, including failed logins, brute-force patterns, suspicious IP activity, MFA failures, forced logouts, and account suspensions. Engineering alerting routes signals to an on-call channel in real time.
Is support available around the clock?
Support is delivered through an in-app chat, not a mailbox. Messages are mirrored in real time to the Technical Team. If no human replies within 60 minutes, an AI assistant posts an interim answer. We do not publish a contractual SLA — we are transparent that this is a coverage mechanism.
What happens to data sent in support chat?
Attachments are written to a non-public storage disk and can only be retrieved through an authenticated endpoint. Message text and attachments are mirrored to Discord for the Technical Team. Support chat is a support channel, not a secure transfer channel — do not send passwords or API keys through it.
How does the bug reporting system work?
The Report Issue action captures a screenshot automatically (reviewable before sending), collects your description and severity, and attaches URL, route, resource context, and parsed browser info. Reports are tracked with status lifecycle and alert the Technical Team immediately.
How are third-party vendor risks managed?
We maintain the subprocessor inventory published on this page. Subprocessors are selected where a specialist offers stronger security than we could operate — payment processing is handled entirely by Stripe so card data never reaches our systems.
What about business continuity?
Automated database backups run daily with defined retention. Backup runs are recorded with success/failure status so failures are visible rather than silent. Backup files are written to storage that is not web-accessible.