Security

• In transit: TLS 1.2+ for every connection (web, API, mobile). HTTPS-only, HSTS enforced.
• At rest: AES-256 via the managed Postgres provider (Neon) on encrypted volumes. Backups are encrypted to the same standard.
• Secrets: Application secrets stored in Railway's managed secrets store, scoped per environment, never written to logs.

• Tenant isolation is enforced by the database, not by application code. Every business-data table has PostgreSQL row-level security enabled and forced, so policies apply even to the role that owns the tables. Most tables carry an org_id column; the remainder inherit tenancy through a parent record, and their policies reach through that parent. There is no shared catalog or shared competitor index across organisations.
• Buying-group clean rooms compute aggregates server-side without ever materialising a cross-member join. Members see only what their administrator explicitly grants.
• Application requests run as a dedicated database role that cannot bypass row-level security, with the tenant scope set per transaction. Trusted background workers (matching, scraping, alerting) legitimately need to act across tenants, and do so through one explicit, audited bypass path rather than by holding wider privileges — so the boundary is crossed deliberately and visibly, never by default.

• Region: Primary database and application services run in the Asia-Pacific (Singapore) region, co-located to keep request latency low for Australian merchants. A2E Group Pty Ltd is an Australian company and remains subject to the Australian Privacy Principles wherever the data is processed.
• Transfers: Some sub-processors (listed in our Privacy Policy) process limited data in the United States and other regions, under contractual clauses substantially equivalent to the EU Standard Contractual Clauses where the GDPR applies. We do not claim data never leaves a single region — we tell you exactly where it goes.
• Infrastructure: Railway managed services on top of AWS underlying infrastructure (SOC 2 Type II, ISO 27001 inherited at the infra layer).
• Database: Neon serverless Postgres with point-in-time recovery and multi-AZ durability.

• Role-based access inside each org: owner, admin, and member. Approval authority (margin floor breaches, manager sign-off) is gated to owner and admin.
• Sign-in is email and password today, with passwords hashed using Argon2id. Single sign-on (SAML/OIDC) and SCIM provisioning are on the roadmap — talk to us if they gate a deployment.
• API keys are scoped per integration with rotation and revocation controls. We do not store passwords — we hash with Argon2id.

• Every margin-affecting decision (approval, override, rebate edit, cost-structure change) writes an append-only audit_events row capturing the actor, timestamp, frozen economics, and reason.
• Audit events are exportable as CSV/JSON for finance and compliance review. They're never amended, never deleted.
• Margin calculations on the Decision Desk are deterministic — the same inputs produce the same number six months from now. AI explains. Code calculates.

• Formal attestation: we hold no SOC 2 or ISO 27001 attestation of our own. The controls described on this page operate today, but no audit engagement is currently under way — we would rather say so than imply one. This line will change when that changes.
• Australian Privacy Act (APP): MarginShield is operated by A2E Group Pty Ltd, an Australian entity, and follows the Australian Privacy Principles for personal information handling.
• GDPR: Available via Data Processing Agreement — see our DPA.
• PCI scope: MarginShield never stores card data. Stripe handles all payment-card flows; we receive tokenised references only.

We monitor application health, error rates, and anomalous access patterns via Sentry and Better Uptime. Customers are notified of security-relevant incidents that affect their data within 72 hours of detection, in line with APP and GDPR requirements. Security questions or disclosure: security@marginshield.io.

• We do not move money, hold customer funds, or execute supplier payments. We compute margin and surface decisions.
• We do not share or sell competitor pricing data observed in your tenant. Public-web observations belong to your org and stay there.
• We do not train models on your data. Anonymised, aggregated usage analytics are kept for product improvement only.