Encryption in transit and at rest
All traffic to BeverageStack runs over TLS 1.2 or higher. Customer data is encrypted at rest in the managed Postgres database and in object storage.
Trust
Security, privacy, and how we operate.
BeverageStack handles commercial data that distributors depend on. This page explains the controls we operate, the data we hold, and how to reach us about a security or privacy question.
Tenant isolation by design
Every record is scoped to a tenant. Database row-level security policies enforce that scope at the engine, so a query can only ever return data for tenants the signed-in user is a member of.
Authentication and roles
Sign-in is handled by a managed auth provider with email/password and Google. Inside the app, role-based permissions plus per-user overrides control what each person can see and do.
Backups and recovery
The managed database takes automatic daily backups with point-in-time recovery. Storage objects are versioned and replicated by the platform provider.
Audit logging
Sensitive changes — role assignments, permission overrides, pricing edits, posting reversals — are written to an append-only audit log that admins can review.
Continuous security review
We run automated security scans against the application and database on every change, and we triage findings before they reach production.
Data we hold
BeverageStack holds the operational data a distributor needs to run the business: product catalogue, suppliers, customers, contacts, warehouses, stock balances and movements, batches and expiry dates, quotes, orders, shipments, invoices, payments, pricing, and related documents. We do not collect end-consumer personal data, and we do not process card payments directly.
Access and sub-processors
Customer data is accessed by BeverageStack staff only when needed to support a customer request or investigate a fault. Infrastructure is operated through reputable cloud sub-processors for hosting, authentication, database, storage, email delivery, and analytics. A current sub-processor list is available on request.
Reporting a security issue
If you believe you have found a security vulnerability in BeverageStack, please contact us through the contact page and mark the message as a security report. We aim to acknowledge valid reports within two business days.
This page describes the controls we operate today. It is not a certification or an independent attestation; specific contractual commitments live in your subscription agreement.
Questions about security or data handling?
We're happy to walk through how BeverageStack protects your operation in a short call.