Controls in place
Row-level security on every table
Every table in the database has row-level security policies enabled, so data access is checked by the database itself, not only by the application code.
Per-workspace data isolation
Access to a workspace's data requires being the owner or an active team member of that workspace. One trader's sales, staff and events are never visible to another.
Private storage with signed URLs
Files such as business assets, event photos, attachments and staff documents are stored in private buckets. They are only ever served through short-lived signed URLs, never public links.
Server-side authorisation for privileged actions
Admin and other privileged actions are re-checked on the server on every request — role gating in the interface is a convenience, not the actual security boundary.
Encrypted transport
All traffic between your browser and CartFlow travels over HTTPS/TLS.
Integration tokens never exposed to users
Access and refresh tokens for accounting integrations such as Xero are stored in columns that ordinary users and the browser can never read — only trusted server-side processes can use them.
Audit logging in the admin panel
Sensitive administrative actions are logged so the team can review what changed and when.
Role separation
Accounts are separated into owner, staff and admin roles, each with a distinct, deliberately scoped set of permissions.
Shared responsibility
Security is a shared responsibility between CartFlow and every workspace owner. We're responsible for the platform: enforcing data isolation, keeping infrastructure patched, and protecting the controls listed above. Workspace owners are responsible for what happens within their own account — choosing strong, unique passwords, deciding who they invite as staff or admins, keeping their own devices secure, and reviewing who has access to their workspace over time.
Report a vulnerability
If you believe you've found a security issue in CartFlow, please tell us — we'd rather hear about it from you first. Get in touch via our contact page with a description and, if possible, steps to reproduce it. We treat every report seriously and will follow up directly.