Security you don't have to think about
What we do today, what's coming next, and where the data lives. Honest, specific, no buzzword bingo.
Data protection
Every byte you put into SalesThumb is encrypted in flight and at rest.
- LiveTLS 1.2+ enforced on every connection — HTTP traffic is automatically upgraded.
- LiveDatabase encryption at rest (Neon managed Postgres on AWS).
- LiveFile storage encrypted at rest on Cloudflare R2 (AES-256).
- LiveFranchisee bank routing and account numbers, and the name on the account, are encrypted by the application (AES-256-GCM) before they reach the database.
- LiveUploaded photos and documents are kept in private storage and opened through short-lived signed links. Only business images meant to be public, like shop logos and product photos, use stable links.
- RoadmapCustomer-managed encryption keys (BYOK).
Tenant isolation
Shops can't see each other's data. Period.
- LiveEvery tenant-owned row carries a shopId or orgId; every query filters by it.
- LiveServer-side guard at the procedure layer — never relying on the client to scope.
- LiveSubdomain routing per shop — no cross-tenant cookie reuse.
- LiveHQ org admins access child shop data only through server-side org-membership checks.
- LiveAutomated tests check that one shop can't read or change another shop's records, and a check on every code change flags new shop-data queries that don't filter by shop.
- RoadmapA second, database-level layer on top of the above: Postgres row-level security, so the database itself refuses a cross-shop read even if a query missed its shop filter.
Authentication & access
Strong defaults, role-based controls, and single sign-on with Google.
- LiveEmail + password with scrypt hashing (Better-Auth), passwords checked against known data breaches at sign-up and reset, repeated-guess lockout, and mandatory two-factor sign-in for owners and admins, plus Google OAuth sign-in.
- LiveRole-based access: Owner, Admin, Manager, Technician, Front Desk, Service Writer per shop, plus owner-configurable permission sets for HQ/franchise orgs.
- LiveTwo-factor authentication by authenticator app (TOTP) or SMS, with backup codes. Required for every shop and org Owner and Admin, and can be switched on for a whole shop or org team by SalesThumb support.
- LivePasskey (WebAuthn) sign-in. A passkey sign-in counts as two-factor verification.
- LiveSession management from settings — see every signed-in device and log any of them out, or all of them at once.
- LiveOptional CIDR-based IP allowlist to restrict our own internal admin console.
- RoadmapSAML / OIDC single sign-on for Pro.
Application security
Boring fundamentals done right.
- LiveTypeScript end-to-end + Zod input validation on every API procedure.
- LiveDrizzle ORM uses parameterized queries — user input is never concatenated into SQL.
- LiveCSRF protection on cookie-authed routes; same-site session cookies.
- LivePayment webhook signature verification on every event.
- LiveTwilio webhook signature verification on every inbound SMS / call status.
- LiveRate limiting on authentication and other sensitive endpoints.
- LiveDuplicate-submission protection (idempotency keys) on key actions such as recording payments, inventory deductions, royalty payments and group texts.
- LiveSSRF guard on every tenant-configured outbound URL (integrations, webhooks) — blocks internal/private-network targets, including DNS-rebinding protection.
- RoadmapAnnual third-party penetration test.
Infrastructure
Modern, audited platform partners do the heavy lifting — the certifications below are the providers' own; SalesThumb's own SOC 2 is not yet started (see Compliance).
- LiveApp tier on Vercel — SOC 2 Type II certified, SSAE 18, HIPAA BAA available.
- LiveDatabase on Neon — SOC 2 Type II, 7-day point-in-time recovery.
- LiveFile storage on Cloudflare R2 — SOC 2 Type II, ISO 27001.
- LiveAccount email (verification, password reset, sign-in links) sent through Google Workspace.
Operations & response
What happens when something goes wrong.
- LiveContinuous database backups with 7-day point-in-time recovery.
- LiveAudit log per shop — every settings change, role change, and sensitive action recorded.
- LivePublic status page at salesthumb.com/status.
- LiveIf a security incident affects your data, we'll notify you directly, in line with applicable breach-notification laws.
- RoadmapPublished RTO / RPO targets and disaster recovery drills.
Compliance & certifications
Where we are today; we'll publish artifacts as audits land.
SOC 2
Not startedNo third-party audit engagement yet. Planned post-launch — we'll publish real dates once an auditor is engaged, not before.
GDPR (Data Processing Addendum)
On requestSalesThumb is currently offered to US businesses. Our role as a processor for shops is described in the Privacy Policy; email hello@salesthumb.com if you need a signed data processing agreement.
PCI compliance
By designCard data is handled entirely by our payment processor — we never store full card numbers on our servers.
TCPA opt-out
EnforcedSTOP / START keywords are honored automatically; a STOP blocks further texts to that number.
Common questions
Where is my data stored?+
Application data lives in a managed Postgres instance on Neon (AWS us-east-1 by default). Files (photos, PDFs, certificates) live on Cloudflare R2 with global edge distribution. Both providers carry SOC 2 Type II attestations.
Can SalesThumb employees see my data?+
Routine support happens through impersonation tokens that are scoped, time-bound, and recorded in our audit log. We don't browse customer data for any reason except a documented support request.
What happens if I cancel my subscription?+
Canceling doesn't automatically delete anything — your data stays where it is, and you can export it, until you ask us to delete it. Request deletion at salesthumb.com/privacy/delete-my-data or by emailing hello@salesthumb.com.
Do you store credit card numbers?+
No. Card details are tokenized by our payment processor at entry and never reach our servers. We keep only the payment processor's reference IDs for card payments and saved cards.
How do I report a security issue?+
Email hello@salesthumb.com with a description of the issue and steps to reproduce. We prioritize high-severity issues. We don't have a paid bug bounty yet but will publicly credit responsible disclosures.
Found a vulnerability?
Responsible disclosure is welcomed and credited. Email hello@salesthumb.com with reproduction steps and we'll follow up.