Security Overview

Every tenant-scoped database table is protected by PostgreSQL row-level security. Application access cannot bypass those policies. Roles and permissions limit actions and protect sensitive cost, margin, and financial data. Administrative and system operations use narrowly scoped paths and are audited.

• HTTPS encrypts data in transit.
• Marketplace and payment integration secrets are encrypted before storage.
• Known secrets and personal fields are redacted from application logs.
• Backups and object storage use encryption and restricted credentials.
• Append-only audit, stock, and accounting records preserve an accountable history.

Business mutations and outbound events commit atomically so a crash cannot silently lose a stock, accounting, or notification event. Consumers are idempotent, financial journals must balance at write time, channel orders are uniquely constrained, and malformed eBay data is isolated rather than retried indefinitely.

Backend logs, metrics, traces, job health, readiness checks, and self-hosted error tracking support detection and diagnosis. Critical process failures, database unavailability, and dead or stalled jobs page operators. Confirmed incidents are contained, investigated, remediated, and communicated to affected customers as required by contract and law.

Changes pass automated formatting, type, test, and production-build gates. Dependencies and infrastructure are maintained through controlled releases. Database backups support point-in-time recovery, and operational runbooks cover deployment, secrets, incidents, and restoration.

Customers must use unique credentials, invite users individually, assign least-privilege roles, remove departed users, secure connected accounts, verify imports and accounting outputs, and promptly report suspicious activity.

Report a suspected vulnerability privately to security@lakop.app. Include reproduction steps and avoid accessing other users’ data, disrupting service, or publishing details before remediation. We do not authorize destructive testing.