Built like it holds money. Because it does.
Wallets, payments and resellers mean security is not an add-on. Here is what protects your store today.
Accounts
Two-factor sign-in
Authenticator apps for staff; mandatory for platform administrators.
Staff roles
Eight roles; every admin page checks permissions.
Brute-force limits
Sign-in, 2FA codes, password resets and signups are rate-limited.
Audit log
Changes are recorded with who and when.
Platform
Strict browser policy
A content security policy with per-page nonces blocks injected scripts.
Outbound guard
Webhooks, supplier calls and callbacks can only reach public internet hosts.
Edge protection
Traffic is filtered at Cloudflare; the platform only accepts traffic from it.
Patched
Current PHP and dependencies, with automatic security checks on every release.
Data
Nightly encrypted backups
Stored off-server, with restore tests every week.
Secrets encrypted
SMTP passwords, API secrets and 2FA secrets are encrypted at rest.
Your money stays yours
Customer payments go to your own wallet addresses.