Security · DPA overview
Your customers’ SKUs, rates & COAs stay theirs.
PackFlow is built on Supabase (PostgreSQL + Auth + Storage) with row-level security. Every query is org-scoped — a buyer can never see another brand’s data, and vendor staff see only what their role allows.
Org isolation (RLS)
portal_users, orders, SKUs, documents — all filtered by org_id at the database. No app-level “hope”.
Role-based access
Administrator / Production / Prepress / CS vs Brand Owner / Procurement / Quality Viewer. canApprove gates artwork sign-off; Quality Viewers are view-only.
Audit trails
Every approval, stage move, ETA change, archive clearance stamped with actor + role + timestamp. Exportable for customer audits.
Encryption + backups
TLS in transit, encrypted at rest on Supabase. Point-in-time recovery, daily backups. Storage buckets private per org.
Document control
Versioned proofs (v1, v2…), revision-tracked dielines, COAs immutable once issued. Nothing silently overwritten.
Responsible disclosure
Report issues to [email protected]. We acknowledge in 48h, patch criticals first, and publish a post-mortem to affected vendors.
Subprocessors & data residency
- Hosting + DB + Auth + Storage: Supabase (AWS-backed, region pinned at onboarding — ap-south-1 default for India).
- App hosting: Vercel (or your VPC on Enterprise).
- No ad trackers. Product analytics only with vendor consent.
- DPA available on request — ask for the signed copy.
Your responsibilities
Keep user lists current (disable leavers), grant canApprove sparingly, and download COAs you must retain per your own QMS. We provide the trail — you own the SOP.