Security & data

Your roastery's data stays yours, separate from every other customer's.

Isolated workspaces.: Every roastery's data is separated from every other customer's. A user can only ever see their own workspace.
Role-based access.: Permissions are enforced on our servers, not just hidden in the interface.
Secure sign-in.: Passwords are hashed (never stored in plain text). Sign-up requires email verification with a 6-digit code. Sign-in attempts are rate-limited and accounts are protected against repeated guessing.
Encrypted in transit.: All traffic is served over HTTPS.
Uploads are checked.: Images are validated on their actual contents before use.
Payments: are handled by Stripe. We never see or store your card number.
Staff access is controlled.: Our support staff sign in with email verification, every action is audit-logged, and any "view as customer" session is time-limited, clearly marked and logged. Read-only mode is available.
Monitoring.: Uptime and error monitoring run around the clock.
Your data is yours.: Export your records to CSV or JSON from Inventory, Allocations, Roast Sessions, Cupping, Contacts, Profiles and Journal at any time.
Blind-cupping integrity.: Scores and batch codes of a blind session are hidden from anyone outside it.

Know every lot, every roast, every buyer, every dollar.