How your data is kept

The app runs each business on its own database, checks every action on the server, and keeps the keys out of the app. What that means in practice, in plain words.

Your business is its own database

Every business gets its own Supabase project: its own Postgres database, its own photo storage, its own encrypted vault for keys, its own logins. No shared table holds two businesses' records.

The business that offers the app (Vaultman LLC) keeps only your business name, your app address and your database's publishable key — enough to point the app at your database, and nothing from inside it.

Your data is yours: the owner can export everything (every table as CSV, photo links, the names of keys on file) from Settings at any time, and can close the business from the same place. A closed business is kept for 30 days — reopen and nothing is lost — then removed.

Every door is checked in the database

Row-level security is on for every table. Nearly everything the app does runs as a database function that checks who is calling and what their role allows; the browser cannot skip the check because the check is not in the browser.

Roles: owner, manager, shipper, viewer, accountant. A shipper reads views that leave out cost, melt and profit. Only the owner changes roles and the who-sees-money switches.

Not signed in means almost nothing: one function answers "which database serves this address" and that is all.

Public pages (a piece page, a wholesale list, a consignor's list, an offer) show exactly the one record a link's token points to, and the forms behind them are rate-limited.

Keys and secrets

API keys, marketplace tokens, email keys and the label-printer signing key are kept in the database's encrypted vault. The app never stores or shows them; it only ever learns "on file" or "not on file". Server functions read them when they act for you.

Marketplace connections (Whatnot, eBay) use the marketplace's own sign-in and consent screen; the app receives a token scoped to what it needs and renews it itself.

Logins

Passwords and sessions are handled by Supabase Auth; the app never sees a password. Leaked-password protection and two-factor (authenticator app) are available, and an owner can require two-factor for every role.

New people get in only when an owner adds them under Settings > People. Every sign-in is noted (device, date, two-factor or not), and the owner signs off a review of all logins on a schedule.

In transit, at rest, and over time

HTTPS everywhere; the app is served by Cloudflare and talks only to your database's address.

Supabase encrypts storage at rest; vault entries are encrypted again on top of that.

Changes to stock, orders, settings and people are written as an append-only trail, so what happened can always be read back.

Backups: a one-click export in the app; Supabase keeps its own daily copies of the database as well. The app watches its own build — every function and view is fingerprinted and compared with the known-good build — and reports script errors from the floor so breakage is seen, not heard about.

Who else touches the data

A business's own exports and backups go wherever that business keeps them (its OneDrive, a drive at home); those copies are plain files and are that business's to protect.

What we do not claim

The app itself has not been audited by a third party. The infrastructure it runs on has (below). If your organization needs a SOC 2 report for the app, ask — the policies, access reviews and change records exist and an audit can be scheduled.

Questions, or a security concern to report: [email protected].

Last reviewed October 2026.