Many clients under one roof, and none of them can see each other.

Authentication and access

• Roles and permissions. Warehouse staff and client users each get a role with an explicit permission set. Every API route declares the permission it requires, and a boot-time check refuses to start if a route is left unguarded.
• Client portal entitlements. What a client's users can see is switched on per company by the warehouse, and further limited by the user's role.
• Session revocation. Deactivating a user, changing their password or changing their role invalidates their existing sessions immediately, not at expiry.
• Password recovery uses single-use, time-limited links. Login attempts are rate-limited.
• API keys for client systems are scoped per client and per capability, shown once, stored hashed, and revocable at any time.

Per-client isolation

Every table that holds client data carries the owning tenant, and row-level security in the database enforces the boundary on every query. A client's portal users only ever reach their own company's rows; warehouse users are fenced to their warehouse. Integrations run per client with their own credentials.

Encryption

• In transit: TLS on every connection to the dashboard, the portal, the API and between our services and hosting providers.
• At rest: the database and file storage are encrypted by the hosting providers. Integration credentials such as store tokens, marketplace secrets and SFTP passwords are additionally encrypted by ShipFlow with AES-256-GCM under a key that lives only in the server environment.

Hosting: ours or yours

Full SaaS. The application runs on Railway, the database on Neon and the web front ends on Netlify, all in United States regions, each with their own SOC 2 programmes. Documents and photos are stored in Amazon S3 with server-generated keys and time-limited download links. We hold the keys and run the backups.

Licensed. The same software runs on infrastructure you control: your servers or your cloud account, in the region you choose. You hold the database, the file storage and the encryption keys. We ship updates quarterly and security fixes between releases; you decide when they are installed. Our access to a licensed installation is only what you grant for support.

Audit logging

Administrative and data-changing actions such as user changes, permission changes, integration changes, overrides and redactions are written to an audit log with who, what, before and after, and from where. Integration runs keep their own log, including what a connected channel sent when a request could not be processed.

Development practice

Changes ship through automated verification suites that exercise the API against a local database, including isolation checks that assert one client cannot read another's rows. Dependencies are reviewed for known vulnerabilities, and secrets are kept in the hosting environment, never in the repository.

Responsible disclosure

If you believe you have found a security issue, email support@3pltechflow.com with "Security report" in the subject. We acknowledge reports within two business days, keep you informed while we fix, and do not pursue good-faith researchers who respect client data and give us reasonable time to remediate.