Security
Security that holds up to your questionnaire
Inventory data is commercially sensitive, and 3PLs hold it on behalf of their clients. This page describes the controls in Stokrio today and what we're working on next.
Tenant isolation
Every brand and every 3PL client is a separate organisation.
- The organisation for each request is resolved on the server from the session or API key — never from a value the browser can change
- Every database query in the API is scoped to that organisation
- Access to a 3PL client is granted only through membership of that client's 3PL
- Automated tests check that every API route rejects unauthenticated requests and that one organisation cannot read another's data
Access control
Five roles, enforced on the server for every action.
- Owner, Admin, Planner, Warehouse and Viewer roles, each with a defined set of permissions
- Only owners can grant or remove ownership, and an organisation always keeps at least one owner
- Invitations are single-use, expire after 7 days, are stored only as hashes, and can only be accepted by the invited email address
- Client users of a pending or suspended 3PL client cannot use the application
Authentication
Standard, well-reviewed authentication rather than custom code.
- Passwords are hashed with scrypt and must be at least 10 characters
- Sessions use HTTP-only cookies and expire after 14 days
- Sign-in and password-reset endpoints are rate-limited
- Password reset links expire after one hour, and the reset form doesn't reveal whether an account exists
- Shopify sign-in uses OAuth with state verification and HMAC-checked callbacks
API keys and integrations
Least privilege for systems as well as people.
- API keys are shown once and stored only as SHA-256 hashes
- Keys carry scopes (for example, inventory read or write) and can never manage users, integrations or organisation settings
- Inbound Shopify webhooks are rejected unless their HMAC signature verifies
- Outgoing webhooks are signed with HMAC-SHA256 so you can verify they came from Stokrio
- Outgoing webhook URLs must resolve to public addresses; private and cloud-metadata networks are refused
Application security
Defence in depth at the edge.
- HTTPS with HTTP Strict Transport Security
- Content Security Policy, frame-ancestors restrictions and other security headers on every response
- Input validation on API requests
- Shopify's mandatory privacy webhooks (customer data requests and redaction) are handled
In progress
We publish what we haven't finished so you can plan around it.
- Encrypting stored Shopify access tokens at the application layer
- Mandatory email verification for new accounts
- Centralised audit log of configuration changes
- Independent penetration test
Report a vulnerability
If you believe you've found a security issue, email security@stokrio.com with the details and steps to reproduce. Please give us reasonable time to fix the issue before disclosing it, and don't access or change data that isn't yours while testing.
For security questionnaires and due-diligence requests, contact us at the same address.
Questions about security?
We're happy to walk your team through how Stokrio handles your data.