How SortSwift protects your inventory, sales, and customer data, whether you sell from a kitchen table or run a full shop. This page lists only what is in place today.
On this page
Foundation
Security is fundamental to SortSwift. We work to protect the confidentiality, integrity, and availability of your data, and we keep improving our controls as the platform grows.
Everything on this page describes a control that is in place today. Where a provider we rely on holds a certification, such as Stripe for card payments, we name the provider.
Encryption
The SortSwift website, web app, storefronts, and API are served over HTTPS, and plain HTTP requests are redirected to HTTPS. Encrypted connections protect your data from eavesdropping between your device and SortSwift.
SortSwift's production database runs on a managed database service that encrypts stored data at rest. Passwords are never stored in plaintext; only a bcrypt hash of each password is kept.
Identity
Staff Accounts & Permissions
Store owners can create a separate account for each staff member and choose what each one can see and do, so staff never need the owner's login.
Session Tokens
Signed-in sessions use cryptographically signed tokens, and the SortSwift API checks the token on each signed-in request.
Password Security
Passwords are hashed with bcrypt and are never stored in plaintext.
Payments & Privacy
Card Payments
Card payments are processed by Stripe, a PCI DSS Level 1 certified payment provider. Card details go to Stripe, and SortSwift never receives or stores full card numbers.
Your Personal Data
You can access, update, or delete your personal data by contacting [email protected], as described in our Privacy Policy.
Infrastructure
Cloud Infrastructure
SortSwift runs on established cloud providers. The production database is a managed database service, so the provider maintains the database servers, encryption at rest, and backups.
Network Security
The SortSwift website, web app, storefronts, and API are served through Cloudflare, which filters incoming traffic and protects against distributed denial-of-service (DDoS) attacks.
Application
Rate Limiting
Public endpoints such as storefront checkout, buylist submissions, and customer sign-in are rate limited to slow down abuse.
Security Headers
The SortSwift API sends standard HTTP security headers with its responses.
Response
If we confirm a data breach that affects your data, we will notify affected users without unreasonable delay, as required by applicable law. The notice will say what happened, what data was affected, and what you can do to protect yourself.
If you think your account or store has been affected by a security problem, email [email protected].
Visibility
Errors in the SortSwift app and API are reported automatically to the engineering team so they can be investigated.
The status page checks live whether SortSwift is reachable.
Resilience
SortSwift's production database runs on a managed database service that takes automatic backups, so data can be restored if something goes wrong.
Researchers
SortSwift welcomes security researchers to responsibly disclose any security vulnerabilities they discover. We ask that researchers follow responsible disclosure practices and avoid accessing or modifying data, disrupting services, or publicly disclosing vulnerabilities without first providing us with an opportunity to address them.
If you discover a security vulnerability, please report it to: [email protected]
We will acknowledge your report and investigate it. Thank you for helping keep SortSwift secure.
Contact
For security-related inquiries, concerns, or to report vulnerabilities:
SortSwift keeps improving the security of the platform. No system is entirely immune to security incidents, and this page describes the controls in place on the date shown above.
© 2024-2025 SortSwift, LLC. All rights reserved.Start free on the phone in your pocket. Standard scanning, free and unlimited on every plan, 0% SortSwift commission on POS with Stripe fees passed through at cost, no credit card to begin.