Security at Lux Boutiques

Your store, your customers, and your data deserve to be protected. Here's how we build security into the platform at every layer.

Modern authentication

Sign-in is handled by a centralized identity service using OpenID Connect with the Authorization Code + PKCE flow — the same standard used by major platforms. Passwords are never stored in plain text, and each portal (seller, retail, admin) authenticates independently.

Encrypted in transit

All traffic between your browser, our gateways, and our services runs over HTTPS/TLS. Browser sessions are kept in HttpOnly, SameSite cookies that client-side scripts cannot read, which guards against common session-theft attacks.

Layered architecture (BFF)

Public traffic never talks to our core services directly. A Backend-for-Frontend gateway sits in front of each portal and exchanges your session for a short-lived signed token, so the data tier only ever accepts verified, time-bound credentials.

Secure payments

Payments are processed by Razorpay, a PCI-DSS compliant payment provider. We never see or store your customers’ full card details — sensitive payment data is handled entirely by the payment gateway.

Data isolation

Each boutique’s catalog, orders, and customers are scoped to that boutique. Authorization is enforced on every request so sellers only ever access their own store’s data.

Least-privilege access

Internal services connect to data using role-scoped credentials with only the permissions they need, and administrative actions are recorded in an audit trail.

Reporting a vulnerability

We welcome responsible disclosure. If you believe you've found a security issue, please get in touch with the details and we'll investigate promptly. Please give us reasonable time to address an issue before any public disclosure.

Report a concern →