Clear access. Considered records.

Membership and roles

Workspace access

Workspace context, tenant-scoped data access and PostgreSQL row policies work together to separate ordinary workspace access. Memberships, roles and branch coverage restrict supported actions.

These controls do not eliminate every software risk or replace careful access management. Authorised platform administration is separate from ordinary tenant membership.

Authentication controls

Accounts and connections

Passwords are stored as hashes. Signup verifies the email address before creating a workspace; sign-in throttling and CSRF protections apply to supported flows.

Use HTTPS for access, protect account credentials and revoke access when someone leaves. No single sign-on, multi-factor authentication or whole-platform encryption-at-rest certification is claimed here.

Scoped records

History and assistance

Supported stock and sales actions create operational history. Use it to investigate reported movements and changes; it is not a tamper-proof ledger of every possible action.

Entering a workspace through the support flow requires a current owner/admin grant with time and access scope. Authorised platform-console administration is a separate access path.

Local storage

Offline and shared devices

Supported cached screens and queued submissions live in browser storage on the device. Clearing browser data, storage eviction or losing the device can remove unsent work.

Review waiting and refused submissions before clearing data. A device may show a last-known record while another person changes stock centrally.

Different record lifecycles

Exports, retention and closure

Authorised report exports depend on role and entitlement. Full-workspace export and closure requests need operator assistance; contact the published support channel to discuss scope and identity checks.

Suspension does not itself delete a workspace. Operational records, retained billing/tax records, backups and local-device copies have different lifecycles. No instant deletion from every system or unverified backup/recovery target is promised.

Use the published support channel

Questions or a suspected issue

Describe the issue and give safe reproduction steps. Do not send passwords, API credentials, full stock identifiers or customer records in an initial report.

Support hours and channels are shown below when configured. Dedicated incident response times, hosting locations and legal retention terms require approved operational commitments.