Security & Data Protection

Account security

• Passwords are stored only as salted hashes — nobody at ReloadedSites can read them.
• Sign in with email and password or with Google.
• Password resets use a single-use, time-limited link sent to your email.
• Staff you invite get a role — owner, manager, staff, or accountant — so people only reach what they need.

Data separation

Every business is scoped to its own tenant and enforced by database row-level security, not just by the app. A request that isn't yours returns nothing, even if someone guesses an address or an identifier.

Encryption and transport

All traffic runs over HTTPS with modern TLS. Data is encrypted at rest by our hosting provider. Uploaded images sit in a private store and are served through short-lived signed links rather than public URLs.

Payments

Card details are handled by a regulated payment processor and never stored on our servers. We keep only the reference we need to match a payment to a subscription or an order.

Backups and continuity

• The database is backed up automatically with point-in-time recovery.
• Backups are encrypted and stored separately from the live system.
• Restores are tested so recovery is a routine operation, not an experiment.

Auditing and monitoring

Order status changes and stock adjustments are recorded with who or what caused them, the reason, and the time, so you can trace any change to your inventory. Application errors and unusual activity are monitored continuously.

Incident response

• We investigate any suspected breach immediately and contain it first.
• Affected merchants are notified without undue delay, with what happened and what to do.
• Where the law requires it, we notify the relevant authority.
• After the fact we publish a summary and the fix to affected customers.

What we ask of you

• Use a long, unique password and never share your login.
• Remove staff accounts as soon as someone leaves.
• Only collect customer information you actually need, and keep it confidential.
• Tell us straight away if you suspect your account has been compromised.

Reporting a vulnerability

If you believe you have found a security issue, email us with the details and steps to reproduce. Please don't access other people's data or run disruptive tests. We acknowledge reports within 3 business days and will keep you updated until it's resolved.