Security
Your unit costs, suppliers, and buyers are the most sensitive numbers in your business. Here is how Motherstock protects them.
People see only what their job needs
Every account has a role: Admin, Manager, Shift lead, Packer, Receiver, Returns, Bookkeeper, or Viewer. Each role allows a fixed set of actions, and the server checks that set on every request, not just in the screen.
- Costs, profit, and supplier prices are removed from what the server sends to anyone without cost access. A packer never sees what a unit cost.
- New accounts start as Packer, the narrowest role that can work the floor.
Every action is on the record
The audit log records who signed in, packed an order, received stock, changed a return, or edited a user, and which order, serial, product, or person each action touched. Admins can filter it by person, action, and date.
Sign-in
- Two-step sign-in with an authenticator app, with backup codes. Admins can require it for Admins or for everyone.
- Passwords are 12 characters or more and stored with Argon2id.
- An Admin-set password is temporary: the person must choose their own before they can do anything else.
- Changing or resetting a password signs that person out everywhere else.
Our support team stays out unless you let us in
Support access is a switch your warehouse owner controls. While it is off, our support account can't sign in to your warehouse. While it is on, everything support does is tagged in your audit log so you can see it separately.
Infrastructure
- All traffic is encrypted with HTTPS.
- Secrets such as ShipStation API keys are kept in a secrets manager, never in code.
- Every update takes a database backup before it changes anything.