Security at OrderOps
Credential encryption, org isolation, audit logging, and what we do not store.
What OrderOps encrypts, how organisations are isolated, what gets logged, and what we deliberately do not store. Short version: your carrier accounts are encrypted, your data is fenced off at the query level, and there are no passwords to steal because there are no passwords.
Credentials are encrypted at rest
Carrier credentials — AusPost, StarTrack, Team Global Express — and Shopify access tokens are encrypted with AES-256-GCM envelope encryption before they touch the database. Each secret gets its own IV, and the encryption key lives in the server environment, never in the database alongside the data it protects.
Organisation isolation
Every read and write is scoped to your organisation at the query level, and our integration tests run two organisations side by side to prove inventory operations cannot cross between them. Your carrier accounts are yours alone — there is no shared account and no fallback to anyone else's contract.
Sign-in
Magic-link email sign-in, plus Shopify OAuth for store connections. We never store a password because there is none — a sign-in link is emailed to you each time. Access inside the app is governed by roles & permissions.
Audit trail
Every inventory mutation is recorded with its actor, source and before/after values, and shipping, member and warehouse changes are audit-logged. The macOS print client keeps its own log of carrier, service and timestamp per print — without customer details.
The print client
- Listens on 127.0.0.1 only — unreachable from the network, and non-loopback connections are rejected outright.
- Every print call carries a bearer token, validated with a constant-time comparison.
- Pairing is a one-shot nonce handshake between the browser and the agent on the same Mac — no tokens to copy, nothing reusable to intercept.
Operations
- Errors go to Sentry with personal data redacted before submission.
- The database is backed up daily.
- Shopify webhooks are HMAC-verified and deduplicated before they touch your data.
What we do not store, and honest limits
- No card numbers — Stripe handles payment details end to end.
- No public API. Access is through the app, the iPad picker and the paired print client — all session- or token-authenticated.
- No SAML SSO. Sign-in is magic-link email and Shopify OAuth.