Security

How Scan & Shoot protects your workspace, in plain language. Last reviewed October 2026.

Your data stays in your workspace

• Every record — batches, items, photos, connected platforms — is tagged with your workspace, and the database enforces that boundary on every read and write (row-level security). The app cannot show one customer another customer's data even by mistake.
• Every server request re-checks that the thing you are acting on belongs to your workspace before touching it.
• Only workspace owners can invite or remove people, and an existing account joins a workspace only after its owner clicks the invitation link.

Signing in

• No passwords to steal: you sign in with a one-time link sent to your e-mail. Phones are paired with a one-time code that expires in ten minutes and works once.
• Sessions use secure cookies over HTTPS only; the site enforces HTTPS (HSTS, preloaded).

Credentials and payments

• Credentials for the platforms you connect (3Dsellers, Shopify, Sellbrite) are encrypted at rest with AES-256-GCM. They are decrypted only on the server, only to send your drafts, and never shown back to the browser.
• Card details never touch us. Payments, receipts and cancellations are handled by Stripe (PCI DSS Level 1); we store only your Stripe customer reference and subscription status.
• Secrets live in the hosting platform's protected settings, never in the code.

Photos

• Uploads are limited to JPEG, PNG and WebP of up to 10 MB, go straight from the phone to storage over HTTPS, and are stored under a path only the server can mint.
• Photo files are served from unguessable addresses without a login, so that your listing platform can fetch them during export. Folder listings are restricted to members of the workspace.
• Photos are deleted automatically 30 days after their item is exported.

Hardening

• Security headers on every page: no embedding in other sites (clickjacking), no MIME sniffing, strict referrer policy, camera access only on the phone page.
• Incoming webhooks from Stripe and Shopify are signature-verified before anything is processed; Stripe events are applied in order.
• Exports neutralise spreadsheet formulas, so a supplier's manifest cannot plant a formula that runs when you open the file in Excel.
• All input is validated on the server; the app uses current, maintained libraries and is reviewed against the OWASP checklist.

Where it runs

• Database and photo storage: Supabase (AWS, United States), with daily backups. Application: Netlify (AWS, United States). Both are SOC 2 Type II audited providers.
• The site is watched from outside every five minutes and the team is alerted to errors automatically.

Reporting a problem

Found something? Write to support@scanandshoot.com. We read every report and fix confirmed issues quickly; please give us a reasonable chance to do so before publishing details.

See also the privacy summary and the terms.