Security
What protects your data, and what does not yet.
Setful is early. The useful version of this page lists both sides, so you can decide rather than assume. If a control you need is in the second table, it is not there yet.
In place
Controls that exist today
- Separation between businesses
- Every query is scoped to your organisation, and each record is re-checked against it on the way in and on the way out.
- Role-based access
- Warehouse, driver and crew accounts see schedules, manifests and scanning. They never see quote pricing, margins or finance.
- Sign-in
- Six-digit codes sent by email, stored hashed, rate limited and capped on attempts. There is no password to leak.
- Two-factor authentication
- Optional, from any authenticator app, with single-use recovery codes. A code cannot be reused inside its own thirty seconds.
- Signed-in devices
- Settings lists every device on your account with when it was last active, and signing one out takes effect on its next request.
- Customer links
- 256-bit random tokens, checked against the exact record they open. One booking’s link cannot fetch another booking’s invoice.
- Audit trail
- Acceptance, pricing and stock overrides, payments, cancellations, exports and support access are all recorded and cannot be edited.
- Safe retries
- Acceptance, warehouse scans, webhooks, automations and API writes all tolerate a retry without duplicating anything.
- Signed webhooks
- Sent with a timestamped signature, so a captured request cannot be replayed later.
- No card data
- Setful stores no card numbers, because card payments are not built at all.
Not yet
Controls that do not exist
- Independent security review
- Required before launch. Not yet commissioned.
- Penetration testing
- Not yet performed.
- Database-level separation
- Tenant scoping is enforced in application code, checked by an automated guard that fails our build on an unscoped query — but not yet by Postgres row-level security, which is the stronger end state.
- Distributed rate limiting
- The current limiter runs in one process. It stops casual abuse, not a determined distributed attack.
- Single sign-on
- Planned for larger organisations. Not built.
- Enforced two-factor
- Two-factor is each person’s own choice. An owner cannot yet require it across their team.
- Certifications
- Setful holds no SOC 2, ISO 27001 or equivalent, and will not display a badge it has not earned.
Reporting a vulnerability
Email marcos@codehardy.com with enough detail to reproduce it. We will confirm we received it, tell you what we find, and credit you if you would like. Please do not test against another operator’s data.
The same approach applies to accessibility and to what is built.
Questions your IT people will ask?
Send them over. We will answer specifically, including where the answer is that we have not done it yet.