Security

This page summarizes the security practices in place for YouPOS. It is intended for transparency — to help Tenants and their customers understand how their data is protected. It is not a full security audit report.

1. Encryption

In Transit

All communication between your browser and YouPOS is encrypted using HTTPS/TLS. Unencrypted HTTP connections to the platform are not permitted.

At Rest

Passwords are stored as one-way bcrypt hashes. We never store plain-text passwords, and no one at YouPOS — including our own team — can read your password.

Database encryption at rest is provided by our hosting infrastructure (Supabase). We rely on our hosting provider's encryption-at-rest capabilities for all stored data.

2. Multi-Tenant Data Isolation

YouPOSis a multi-tenant platform. Each Tenant's data is logically isolated from every other Tenant's data through:

• Row-level security (RLS) policiesat the database level — enforced by PostgreSQL, not just application code. A Tenant can never query another Tenant's records.
• Tenant-scoped database queries — all application queries are automatically filtered to the active tenant using Drizzle ORM, providing a second enforcement layer independent of RLS.
• Server-side session validation — the active tenant identity is verified from the authenticated session on every request before any data is returned.

3. Access Controls

YouPOS implements role-based access control (RBAC) with two role levels per tenant:

• Owner — full access to all tenant features, settings, staff management, and reporting.
• Staff — access to day-to-day operations (job orders, POS, inventory) only. Cannot manage other staff accounts, view financial summaries, or change settings.

A separate Super Adminrole exists at the platform level for platform administration only. Super Admins cannot access any Tenant's operational data.

Permission checks are enforced server-side on every Server Action and API route. UI-level restrictions mirror server-side rules but are not relied upon as a security boundary.

4. Authentication Security

• Authentication is handled by Supabase Auth, which manages session tokens, refresh cycles, and secure cookie handling.
• Login attempts are rate-limited to protect against brute-force and credential-stuffing attacks.
• Sessions use httpOnly cookies — session tokens are never exposed to JavaScript running in the browser.
• Suspicious sessions can be force-invalidated by platform administrators.

5. Backup and Recovery

YouPOS performs automated database backups:

• Daily full backups retained for 7 days.
• Weekly backups retained for 4 weeks.
• Monthly backups retained for 3 months.

Backups are stored separately from the primary database. In the event of data loss, backups provide the ability to restore to a recent point in time.

Note: deletion requests applied to live data may persist in backup archives until those backups expire. See our Privacy Policy for details.

6. Monitoring and Incident Response

YouPOS logs structured application events including authentication attempts, permission-denied events, and application errors. Logs do not include passwords, session tokens, or customer personal data payloads.

In the event of a security incident affecting Tenant data, we will notify affected Tenants without undue delay as described in our Data Processing Addendum.

7. Responsible Disclosure

If you believe you have discovered a security vulnerability in YouPOS, please report it to us before disclosing it publicly. We take security reports seriously and will investigate and respond promptly.

Contact: support.youpos@dfchub.comwith subject line “Security Disclosure”.

We ask that you:

• Give us reasonable time to investigate and remediate before public disclosure.
• Avoid accessing, modifying, or deleting any data that is not your own.
• Not disrupt or degrade the platform's availability for other users.

We do not currently offer a formal bug bounty program, but we genuinely appreciate responsible security research and will acknowledge your contribution where appropriate.

8. Questions

For security questions not covered here, contact us at support.youpos@dfchub.com.