MRSTORE handles sensitive business data — sales, invoices, bank imports, and store photos. Here is how we protect it.
All traffic uses HTTPS with HSTS. Browser security headers (frame protection, content-type sniffing blocks, referrer policy, and a content security policy) reduce common web attacks. Data syncs to a managed cloud database (Supabase) with account-scoped access controls.
Ledger rows, products, and uploads belong to your account and selected stores. Other MRSTORE customers cannot read your data. Access control is enforced in the cloud database (row-level policies), not only in the browser UI.
Staff sign in with their own email after you invite them. You can revoke access without changing your owner password. Prefer employee invites over sharing the owner login.
Payment, bank (Plaid), POS (Square), and mail secrets live in server-side config files that are blocked from public HTTP access. Only public keys (for example a Square application id) belong in the browser.
We do not sell your sales history. We do not use your vendor invoices to train public ad models. We do not share your ledger with other store owners.
Email luckymart323@gmail.com with subject Security, or see security.txt. Please include steps to reproduce and avoid sharing live secrets in the first email — we respond as quickly as possible.