Separated by organization
Every person is limited to their own organization and its sites. Every request is checked on our servers, not only in the app, and a record you are not allowed to see is answered as if it does not exist.
Security
Your data is yours, and only your people see it.
How SupplyStock protects the information your organization trusts us with, and the policies we hold ourselves to.
How we protect it
Roles decide what each person can do
Your administrators give each person the roles they need, by site and by task. Viewing, ordering, approving and administering are separate permissions.
Encrypted in transit
Every connection to SupplyStock, this website included, uses HTTPS with TLS 1.2 or later. Browsers are told to use HTTPS only.
Private files stay private
Documents and private images are stored encrypted and are never public. They open only through a link that expires within minutes, issued after we check you may see them.
Hosted on Amazon Web Services
The platform runs in AWS data centers in the United States. Our services run in private networks with no public address, behind load balancers that accept only encrypted traffic.
Secrets kept out of code
Passwords, keys and connection details live in an encrypted secrets store, never in source code, and each service gets only the access it needs.
Backed up every day
Databases are backed up automatically every day and the backups are kept for seven days, so data can be restored to a point in time.
QuickBooks access is read-only
When an administrator connects QuickBooks Online, we ask only for read access to accounting records. The connection's credentials are encrypted, and you can disconnect at any time from QuickBooks or by asking us.
Changes are recorded
Changes to your setup, stock and orders are recorded with who made them and when, so you can see what changed.
Our policies
The rules we hold ourselves to.
These policies apply to everyone at SupplyStock and to every system that holds your data.
Least privilege
People and systems get the minimum access their work needs. Production access is limited to the staff who operate the platform, and only an administrator role crosses organizations.
Your data, your purpose
We use your organization's data to run the service for you. We do not sell it. Our privacy policy says what we collect, why, who we share it with and how long we keep it.
Reviewed changes
Every change to the platform is tracked in version control and passes automated tests before it is released. Security fixes to the components we use are applied as part of normal releases.
Incident response
If we learn of a security incident that affects your data, we act to contain it, investigate, and tell your organization's administrators without undue delay, with what happened and what we are doing about it.
Leaving SupplyStock
If your organization stops using SupplyStock, you can ask for an export of your data, and we delete or anonymize it as the privacy policy and your agreement describe.
Reporting a security issue
If you believe you have found a security problem in SupplyStock, email info@supplystock.com with the subject "Security report". We will acknowledge it, look into it, and keep you informed. Please do not access other people's data or disrupt the service while testing.
Have a security questionnaire?
Send it to us. We'll answer it as part of your rollout.