Security

Encryption

• Every request is served over HTTPS with TLS. There is no unencrypted path to the app.
• Data is stored on Cloudflare's infrastructure with encryption at rest.

Passwords

• Hashed with PBKDF2 at 100,000 iterations with a unique random salt per user.
• Never logged, never emailed, never visible to us — a password reset creates a new hash rather than revealing the old one.
• Signup enforces a minimum length plus a letter and a number, checked live as you type.

Sessions

• Session cookies are HTTP-only and Secure, so page scripts can't read them.
• Sessions expire after 30 days, and logging out invalidates the session server-side rather than just clearing the cookie.
• Every API route re-verifies the session on each request; nothing trusts a client-side claim about who you are.

Payments

• Card data never touches our servers. Checkout is hosted by Stripe.
• We store only a Stripe customer ID, subscription ID, plan, and payment amounts.
• Stripe webhooks are verified with HMAC-SHA256 signatures and a timestamp tolerance, and every event is processed exactly once.

Access control

• Workspace data is scoped by workspace ID on every query — one organization cannot read another's inventory.
• Owners and members have different permissions: only owners can delete items, manage invites, rename the workspace, or change billing.
• Invite links can be rotated or revoked at any time from the Team page.
• Uploaded photos are served only to signed-in members, or through the specific public scan page for that one item.

Public scan pages, by design

A printed label links to a page anyone holding it can use — that's the entire point of a self-serve checkout system. That page exposes only that single item: its name, tag, photo, status, and current holder. It cannot list your other gear, your team, your values, or your account, and it carries a noindex tag so it stays out of search results.

Infrastructure

• Runs on Cloudflare Workers with D1 (database) and R2 (file storage).
• Cloudflare's network provides DDoS protection and WAF filtering in front of the app.
• Secrets are stored as encrypted Worker secrets, never in the source repository.

Input handling

• All user input is length-capped server-side, not just in the browser.
• Database access uses parameter binding throughout — no string-concatenated SQL.
• Concurrent checkouts of the same item resolve to a single winner; the loser gets a clear conflict message instead of a corrupted record.

What we don't do

• We don't sell or share your data. There are exactly two subprocessors: Cloudflare and Stripe.
• We don't run third-party advertising or profiling scripts.
• We don't train machine-learning models on your inventory.

Honest limitations

We're a small team and we won't pretend otherwise. We do not currently hold SOC 2 or ISO 27001 certification, and we don't offer a contractual uptime SLA outside Enterprise agreements. If your procurement process requires either, contact us before you buy and we'll tell you honestly where we stand rather than waste your time.

Reporting a vulnerability

Found something? Email chomeroller@gmail.com with the details and steps to reproduce. We'll acknowledge within 3 business days, keep you updated, and credit you if you'd like. Please don't run automated scans against production or access data that isn't yours — tell us and we'll reproduce it ourselves.

Questions

Security review before purchase, or a question about any of the above: contact us.