SecurityTrust, specifically
Your margins are nobody’s business. We built it that way.
A grocer’s landed costs and supplier terms are the business. This page says exactly how PalletRow protects them — in plain terms, and only what’s true today.
Isolation, enforced by the database
Every workspace’s rows are walled off by PostgreSQL row-level security — a rule the database applies to every query, whatever the application in front of it asks for.
Two database roles
The application connects with a role that owns nothing and cannot bypass row-level security. The role that can is reserved for migrations and never serves a request.
Forced on every tenant table
Row-level security is forced, not merely enabled, so even the table owner is held to it inside the app connection.
Refuses to start unsafe
At boot the server checks that its own connection is subject to isolation. If it isn’t, it will not start.
The assistant included
AI tools run through the same tenant-scoped connection. There is no side door for software.
People see what their job needs
Roles decide what a person can see and do, and they can be scoped down to individual stores.
Costs stay with the people who need them
A cashier or counter can do their work without ever seeing cost, margin or supplier terms.
Approvals block the write, not the button
When a change needs approval, it cannot be applied without a recorded decision — whether it came from the screen, the API or the assistant.
Two-factor sign-in
Accounts can be protected with a second factor, and repeated failed sign-ins are rate-limited.
Invitations, not shared logins
Everyone signs in as themselves, so every change has a name on it.
A record of everything that matters
When a number looks wrong, the question “how did it get like this?” has an answer.
Inventory is a ledger
On-hand is the sum of recorded movements. Balances are never edited in place, so history can’t be quietly rewritten.
Changes are audited
Prices, counts, orders and permissions are recorded with who made the change and when.
The assistant is accountable
Every action the assistant takes is logged against the person who asked, and it can only use tools that person is allowed to use.
Prices keep their history
Cost and price changes are appended, not overwritten, so past margins stay true.
Integrations that can’t be spoofed
Sales data is revenue. PalletRow only accepts it from senders who can prove who they are.
Signed deliveries only
Square, Clover and Shopify POS deliveries are verified against their signatures before anything is recorded.
No unsigned direct feed
The direct feed requires a per-connection signing key. There is no “just this once” unsigned mode.
Keys you can rotate
Rotate a connection’s key in place, and see every recent delivery — including the ones that were refused, and why.
A strict browser policy
The app ships a per-request content security policy, so injected scripts don’t run.
Where it runs
PalletRow runs on managed infrastructure in the United States, with encryption in transit throughout.
Managed PostgreSQL
DigitalOcean’s managed database, with automatic daily backups and point-in-time recovery. Our restore procedure is documented and has been tested.
HTTPS everywhere
All traffic to the app and the API is encrypted in transit.
Uploads kept private
Documents are stored in private object storage and opened through short-lived signed links.
Your data can leave
Catalog, history and reports export on every plan — including a paused one.
Found something? Tell us.
Security questions, questionnaires and responsible disclosure go to [email protected]. We read every one.