Security
Built for something that writes to your storefront
ParcelAI holds supplier correspondence and credentials that can change what your customers see. These are the controls that exist because of that, described precisely enough to be checked.
Row-level security on every table
Tenant isolation is enforced in Postgres, not in application code. Policies key off the authenticated user, so a bug in the app layer still cannot leak another workspace. Realtime subscriptions honour the same policies.
Credentials in an encrypted vault
Store API keys never occupy an ordinary table column. They are written into Supabase Vault and only a secret identifier is stored against your workspace. The UI is write-only — it cannot read a key back, and rotating one destroys the superseded ciphertext.
Two-factor authentication
TOTP is available on every account and works with any standard authenticator app. Enrolment is self-service from Settings, and removing a factor requires an authenticated session.
Sessions and transport
Sessions live in httpOnly cookies, so no script can read them. HSTS is preloaded, a strict Content-Security-Policy is set on every route, and the app can be framed nowhere.
Auditable by design
Every stock update keeps the source email subject and extract next to the parsed values. Every rule change, sync attempt and sign-in is written to an activity log you can read.
Least privilege
The browser holds only a publishable key with no authority to create stock rows. The ingest worker runs server-side with its own credentials and is the only thing that can write one.
Reporting a vulnerability
If you have found something, tell us before you tell anyone else and we will not pursue you for looking. Send a description and reproduction steps through the contact form. We aim to acknowledge within two working days.
Please do not run automated scanners against production, access data that is not yours, or degrade the service for other customers while testing.
Honest status: ParcelAI is in preview. The controls above are implemented, but we do not yet hold SOC 2, ISO 27001, or an independent penetration-test report. If your procurement process needs one, talk to us about timelines rather than assuming.