Security

Payments and card data

Card details never touch our systems. Payment is handled entirely by Stripe on the merchant's own connected account, which keeps us on PCI DSS SAQ A — the narrowest scope available — and means a breach of our infrastructure cannot expose card numbers, because we hold none.

Tenant isolation

Every record belongs to a tenant, and every dashboard request resolves that tenant from the caller's own session rather than from anything the client sends. No administrative endpoint accepts a store identifier from the browser, so a merchant cannot ask for another merchant's data by changing a parameter.

Access control

• Four merchant roles — owner, admin, staff, viewer — enforced server-side on every request.
• The dashboard hides what your role can't use, but the server check is what actually decides.
• A member may only manage members ranked below them, so nobody can escalate their own privileges.

Data in transit and at rest

All traffic is served over TLS. Database storage is encrypted at rest by our provider. Secrets are held in the platform's secret store, never in source control or configuration files.

Reporting a vulnerability

Report it to security@tokolane.com. Please include enough detail to reproduce it, and give us reasonable time to fix it before you publish.

Our commitment. We will acknowledge your report, keep you updated, and credit you if you want to be credited. We will not pursue legal action against you for research carried out in good faith under the rules below.

Testing that stays in scope:

• Use only accounts and stores you created yourself.
• Don't access, modify, or retain anyone else's data — if you reach it accidentally, stop and tell us.
• No denial of service, no load or stress testing, no spam.
• No social engineering of our staff, our merchants, or our providers.
• Report vulnerabilities in Cloudflare, Neon, Clerk or Stripe to them directly.

[Counsel: confirm this safe-harbour wording, and decide whether a paid bounty is offered before advertising one.]

Incidents

If a personal data breach affects a merchant's data we notify them without undue delay, with what we know and what we're doing about it. Ongoing incidents are posted on our status page.