Security

Each shop's data is kept apart from every other shop by row-level security rules in the database. Some server operations run with elevated access; each one first checks that the signed-in person belongs to the shop.

Passwords are hashed by our sign-in provider. We never see them.

Keys you store with us, such as courier, payment, chat and analytics keys, are encrypted with AES-256-GCM before they are saved. The screen shows only the last four characters and cannot show the key again.

Every page is served over HTTPS with HSTS. Response headers stop other websites from framing the dashboard or checkout, and limit what the browser sends and allows.

Cloudflare Turnstile checks run when someone signs up, signs in or places an order, to stop automated abuse. A real buyer sees at most a short check.

Opening ToruPay or Tanet Chat from TORI, or TORI from them, uses a signed token. It lasts at most 5 minutes, works once, and names both products. An expired, reused or forged token is refused and shown as a short code you can quote to support.

A person who arrives from another Kronx product with an email TORI has not seen gets an ordinary account with no shop and no administrator rights, and only when that product has confirmed the email.

Messages from ToruPay and Tanet Chat are signed. TORI checks the signature, refuses messages that are too old, and ignores duplicates. When one is refused, the shop owner sees it under Connections in Settings.

A payment made in test mode is never counted as real money.

The database is backed up every night, encrypted, to a private bucket. Daily copies are kept 30 days and monthly copies 12 months.

Payments, integration changes and refused sign-in or webhook attempts are recorded with the time they happened.

Use a strong password that you use nowhere else, and keep your email account secure: sign-in links and password resets go to it.

Give staff access only to people you trust, and remove them when they leave.

Guard your ToruPay and courier keys as you would guard cash.

TORI has no security certification such as ISO 27001 or SOC 2, and no independent penetration test yet.

We do not yet check passwords against public lists of leaked passwords.

We cannot promise uninterrupted service or protection from every attack.

Email hello@kronx.studio with what you found, where, and the steps to see it. A machine-readable copy of this contact is at /.well-known/security.txt.

Please do not read or change data that is not yours, do not disrupt the service, and give us reasonable time to fix a problem before you publish it. We read every report.