Every row of data belongs to one business, and the database itself refuses to show it to anyone outside that business, whatever the app asks for. Staff only see the stores and figures their permissions allow.
How are logins protected?
Every back-office login uses two-step sign-in with an authenticator app, enforced by the database, so a stolen password alone can't open your store. Sign-in and sign-up are protected against bots, and failed attempts are limited.
How are the tills protected?
Each till is paired with a one-time 9-digit code and holds its own secret, encrypted with Windows. The owner gets an alert whenever a till is paired. Staff PINs are 6–8 digits and lock out after repeated wrong tries. Fuel dockets are digitally signed so fake codes are refused.
How do you find problems before others do?
We run full security reviews of the system and fix what they find, including small issues, and every change runs through over 500 automated database security checks before it goes live.
Strict content security policy on every page
Webhooks and supplier feeds can't be pointed at internal networks
API keys are scoped, rate limited and revocable
Error details never shown to the public
Common questions
Where is my data hosted?
+
In a managed Postgres database (Supabase) with daily backups. Ask us for current hosting regions and our data processing details.
How do I report a security issue?
+
Email security@betterretailer.com.au. We'll acknowledge it within one business day.