Security

The short version

SupplySmart holds your catalog, customers, orders, invoices, and books — so isolation and safety are designed into the platform, not bolted on. Every distributor's workspace is walled off at the database layer, card and bank details never touch our systems, and the controls below are checked continuously by automated tests and daily monitoring.

Where your data lives

The application runs on Vercel and data is stored in a PostgreSQL database managed by Supabase, hosted in the United States on AWS infrastructure. Data is encrypted in transit (TLS) and at rest. The database is backed up automatically every day.

We don't just take backups — we rehearse restoring them. We periodically restore a backup into a separate test environment and verify it: record counts, invoice amounts checked to the penny, and confirmation that every tenant-isolation policy is present in the restored database. Most recent restore drill: August 2026, passed on all checks. Recovery steps are documented in an internal runbook.

How tenants are isolated from each other

Isolation is enforced by the database itself, not just by application code. Every tenant-owned table carries a restrictivePostgreSQL Row Level Security policy: whatever else a query is allowed to do, the database will only ever return or accept rows belonging to the signed-in user's own distributor, as identified by their cryptographically signed session token. Application bugs cannot override this — a request scoped to the wrong tenant returns nothing.

This rule is also enforced on ourselves: an automated test in our build pipeline verifies that every table containing tenant data carries the isolation policy, so a future change that forgot it would fail our test suite before it could ever be deployed.

Payments

Card and bank account numbers are entered directly on Stripe's hosted, PCI-compliant payment pages and are never stored or seen by SupplySmart. Each distributor collects payments into its own Stripe account (Stripe Connect) — funds are never pooled through us — and payment amounts are computed on our servers from the invoice itself, never trusted from the browser. Payment webhooks from Stripe are cryptographically signature-verified before we act on them.

Access control

Every role in the product (distributor admin, driver, store customer) is verified server-side on every privileged request, and platform operations are additionally restricted to a named allowlist of operator accounts. Within our team, access to customer data is limited to operating and supporting the service. Public payment and statement links use long, unguessable identifiers and are rate limited against enumeration.

Monitoring and abuse prevention

Errors are tracked in real time with Sentry. Sign-ups are protected by Cloudflare Turnstile and by rate limits enforced in the database itself, so they hold across our whole infrastructure. A daily synthetic check exercises the authentication path end to end — including the mechanism that binds a login session to the correct distributor — and alerts us the same day if anything drifts.

If something goes wrong

If a security incident affects your data, we will notify you without undue delay — within 72 hours of becoming aware — with what we know and what we are doing, as committed in our Data Processing Addendum. Your data remains yours throughout: you can export it at any time, and if you leave, we delete it on request.

Reporting a vulnerability

If you believe you have found a security issue in SupplySmart, please email hello@supplysmart.app with the details. We read every report, we will respond, and we will not take action against good-faith research conducted without accessing or disrupting other tenants' data.