Your store, your customers, and your data deserve to be protected. Here's how we build security into the platform at every layer.
Sign-in is handled by a centralized identity service using OpenID Connect with the Authorization Code + PKCE flow — the same standard used by major platforms. Passwords are never stored in plain text, and each portal (seller, retail, admin) authenticates independently.
All traffic between your browser, our gateways, and our services runs over HTTPS/TLS. Browser sessions are kept in HttpOnly, SameSite cookies that client-side scripts cannot read, which guards against common session-theft attacks.
Public traffic never talks to our core services directly. A Backend-for-Frontend gateway sits in front of each portal and exchanges your session for a short-lived signed token, so the data tier only ever accepts verified, time-bound credentials.
Payments are processed by Razorpay, a PCI-DSS compliant payment provider. We never see or store your customers’ full card details — sensitive payment data is handled entirely by the payment gateway.
Each boutique’s catalog, orders, and customers are scoped to that boutique. Authorization is enforced on every request so sellers only ever access their own store’s data.
Internal services connect to data using role-scoped credentials with only the permissions they need, and administrative actions are recorded in an audit trail.
We welcome responsible disclosure. If you believe you've found a security issue, please get in touch with the details and we'll investigate promptly. Please give us reasonable time to address an issue before any public disclosure.
Report a concern →