Architecture
- Managed serverless hosting on Vercel; managed PostgreSQL and S3-compatible file storage in [Hosting region].
- Every customer is an isolated workspace. Every database query is scoped to the workspace of the signed-in user — never to an id supplied by the browser.
- Files are private and served only through short-lived (1-hour), cryptographically signed links.
Data protection
- TLS encryption for all traffic, with HSTS; storage encrypted at rest by our providers.
- Buyer ID numbers and access tokens for connected services (WhatsApp, Telegram, Facebook/Instagram) are additionally encrypted in the application with AES-256-GCM, under keys kept outside the database.
- Payment cards never touch our systems: billing runs through Paddle (Merchant of Record). Installment payments are recorded, not charged, and entries containing card numbers are rejected.
- Marketplace photos are re-encoded with location (EXIF/GPS) data removed. Public sites use no tracking cookies.
Access control
- Owner, admin, member and custom roles with read/write permissions per area (units, offers, sales, payments, settings…), enforced on the server for every action.
- Passwords hashed with bcrypt; sessions revoked on password reset; login rate limiting.
- Staff production access is limited to named administrators; administrator actions are recorded in an audit log.
- Workspace owners and admins can review an activity log of who changed offers, sales, payments, clients, inventory and settings.
- Two-step verification with authenticator apps (TOTP) and single-use backup codes; secrets are stored encrypted.
Privacy controls
- Self-service export of personal and workspace data (JSON).
- Client erasure: delete a buyer, or anonymize one with existing deals while keeping amounts for accounting.
- Account and workspace deletion with a 30-day grace period, then permanent deletion of records and files.
- Automatic retention limits on logs and analytics — see the Privacy Policy.
Operations
- All changes go through version control and pull requests; database changes use versioned migrations.
- Automated database backups with rolling expiry.
- Documented incident response: customers are notified within 48 hours of a confirmed breach affecting their data.
Certifications
Urbanxo is not yet SOC 2 or ISO 27001 certified. Our controls follow the SOC 2 Trust Services Criteria and our infrastructure providers maintain their own certifications. We complete customer security questionnaires and sign a Data Processing Agreement on request.
Report a vulnerability
Email [security email]. Please give us reasonable time to fix an issue before disclosing it, and don't access other customers' data while testing.