Security
Security
The short version: we do not send email on your behalf, we never write to your accounting system, and one customer's data is unreachable from another's by the database itself rather than by our good intentions.
Your email
CostSpring drafts enquiries; you send them from your own client. We do not connect to your mailbox and we do not send on your behalf. Replies reach us only when you forward them, or by a copy address you choose to include.
Your accounting system
The connection is read-only, and that is enforced rather than promised: there is an automated check in our build that fails if any code path calls a write method on an accounting API. We read purchases. We never create, amend or delete anything in your ledger.
Separation between customers
Every tenant-owned table is protected by row-level security in PostgreSQL, and the application connects as a role that cannot bypass it. A missing filter in our own code returns nothing rather than someone else's data. The database refuses; it does not rely on us remembering.
A small number of tables are deliberately shared and each says why in the source: the supplier base, public price indices, and the opt-out list — an opt-out has to be honoured across every customer immediately, or it is not an opt-out.
What suppliers see
A draft never names another supplier, never repeats a rival's figure, never discloses how many quotes exist, and never states a volume commitment. Every generated message is checked against those rules before you see it, and a message that fails is held rather than sent.
Backups and encryption
Traffic is encrypted in transit. Database backups are encrypted at rest. Access tokens are encrypted with a versioned key so a key can be rotated without downtime.
Reporting something
If you find a security problem, write to [email protected]. You will get a human, and we will tell you what we found and what we changed.