Security

• In transit: TLS 1.2+ for every connection (web, API, mobile). HTTPS-only, HSTS enforced.
• At rest: AES-256 via the managed Postgres provider (Neon) on encrypted volumes. Backups are encrypted to the same standard.
• Secrets: Application secrets stored in Railway's managed secrets store, scoped per environment, never written to logs.

• Tenant isolation is enforced by the database, not by application code. Every business-data table has PostgreSQL row-level security enabled and forced, so policies apply even to the role that owns the tables. Most tables carry an org_id column; the remainder inherit tenancy through a parent record, and their policies reach through that parent. There is no shared catalog or shared competitor index across organisations.
• Buying-group clean rooms compute aggregates server-side without ever materialising a cross-member join. Members see only what their administrator explicitly grants.
• Application requests run as a dedicated database role that cannot bypass row-level security, with the tenant scope set per transaction. Trusted background workers (matching, scraping, alerting) legitimately need to act across tenants, and do so through one explicit, audited bypass path rather than by holding wider privileges — so the boundary is crossed deliberately and visibly, never by default.

• Region: Your primary database is hosted in the Asia-Pacific (Singapore) region, to keep request latency low for Australian merchants. Application hosting is as listed in the sub-processors (our Privacy Policy, Section 7, and our DPA, Section 3). A2E Group Pty Ltd is an Australian company and remains subject to the Australian Privacy Principles wherever the data is processed.
• Transfers: Some sub-processors (listed in our Privacy Policy) process limited data in the United States and other regions. Where the GDPR or the UK GDPR applies, our DPA incorporates the European Commission's Standard Contractual Clauses and the UK Addendum to them for the transfer of your personal data to us, and onward transfers to sub-processors rely on those clauses or another safeguard the GDPR recognises. We do not claim data never leaves a single region — we tell you exactly where it goes.
• Infrastructure: Railway managed services (application hosting and the Redis job queue), which Railway runs on its own hardware and on cloud capacity it rents. We do not claim any certification of Railway's or its providers' as our own (see Compliance posture below).
• Database: Neon serverless Postgres with point-in-time recovery and multi-AZ durability.

• Role-based access inside each org: owner, admin, and member. Approval authority (margin floor breaches, manager sign-off) is gated to owner and admin.
• Sign-in is email and password, with passwords hashed using Argon2id, or, for BAFO for Shopify, through Shopify: Shopify proves which staff member is present, and only an email Shopify has verified signs anyone in. Resetting a password ends every session signed in before it. Single sign-on (SAML/OIDC) and SCIM provisioning are on the roadmap — talk to us if they gate a deployment.
• API keys are issued per integration, only by an owner or admin, and can be revoked at any time; to rotate a key, issue a new one and revoke the old. We do not store passwords — we hash them with Argon2id.

• Every margin-affecting decision (approval, override, rebate edit, cost-structure change) writes an append-only audit_events row capturing the actor, timestamp, frozen economics, and reason.
• A copy of your audit events is available on request (privacy@marginshield.io). They're never deleted, and never amended, except that when an account is erased (at its owner's request, or automatically for an account that exists only because BAFO for Shopify was installed, as the Privacy Policy describes) the personal values inside its events (names, email addresses and Shopify user IDs) are replaced with “[redacted]”.
• Margin calculations on the Decision Desk are deterministic — the same inputs produce the same number six months from now. AI explains. Code calculates.

• Formal attestation: we hold no SOC 2 or ISO 27001 attestation of our own. The controls described on this page operate today, but no audit engagement is currently under way — we would rather say so than imply one. This line will change when that changes.
• Australian Privacy Act (APP): MarginShield is operated by A2E Group Pty Ltd, an Australian entity, and follows the Australian Privacy Principles for personal information handling.
• GDPR: Available via Data Processing Agreement — see our DPA.
• PCI scope: MarginShield never stores card data. Stripe handles all payment-card flows; we receive tokenised references only.

We monitor application errors and performance through Sentry. Customers are notified of a confirmed personal-information breach affecting their data without undue delay, and in any event within 72 hours of confirmation, as Section 7 of our DPA sets out. Security questions or disclosure: security@marginshield.io.

• We do not move money, hold customer funds, or execute supplier payments. We compute margin and surface decisions.
• We do not share or sell competitor pricing data observed in your tenant. Public-web observations belong to your org and stay there.
• We do not train models on your data. When our product analytics is switched on, it records the pages you view in our web app under a random identifier, as Section 10 of the Privacy Policy describes, for product improvement only.