Security
Brewmargin holds the numbers you would never pin to the counter: what you pay every supplier, line by line, and what you make on every drink. This page lists the actual mechanisms that guard them — algorithms and defaults, not adjectives.
Your invoices
Every database query is scoped to your organisation's id, and that id comes from your signed session — never from anything in the request. Ask for a record that isn't yours and the answer isn't "forbidden", it's "not found": to you, other cafés' data does not exist.
Every invoice you forward or upload is stored as the original file, served back only to your signed-in team, in a sandbox where nothing can execute. Every price on your dashboard traces back to the exact invoice line that set it.
Invoice files go to Anthropic's Claude API for one purpose: reading the line items. Anthropic does not train models on API data. Nothing lands in your books until you've reviewed and confirmed it — the 30-second check is also a security boundary.
Your forwarding address is a long random token, not your café's name — it can't be guessed from the outside. Duplicate emails are detected and dropped, and the inbound endpoint answers only to a shared-secret webhook.
Your account
Passwords are hashed with Argon2id — never stored, never recoverable, not by us. Passkeys are supported (fingerprint, face or device PIN, phishing-resistant), and any account can add two-factor codes from any authenticator app.
Sessions are short-lived tokens with rotating refresh; refresh tokens are revoked, never silently deleted. Failed sign-ins are rate-limited, and every security-sensitive action is written to an append-only audit log. Raw IP addresses are never stored — only salted one-way hashes.
Square and SumUp connect over OAuth with read-only scopes: we can read your items and sales totals, we cannot move money or touch a payout. Access tokens are sealed with XChaCha20-Poly1305 under a master key before they reach the database. Disconnect any time — the sealed tokens are destroyed.
Members can run the costing day-to-day but can't touch billing, API keys or account deletion — those stay with the owner. Removing a member cuts their sign-in immediately, and invitations expire on their own in 7 days.
Infrastructure
Our servers expose no public HTTP ports at all. Traffic arrives through an outbound-only encrypted tunnel, so there is no origin to attack, scan or DDoS directly.
TLS 1.3 to the edge. Credentials are sealed with authenticated encryption inside the database, and nightly backups are encrypted before they leave the machine, with keys held outside the infrastructure.
Every commit runs a dependency CVE audit in CI, and production containers build from minimal, pinned base images.
Email [email protected] — also published at /.well-known/security.txt (RFC 9116). We respond fast and credit researchers.
Delete your account and everything goes: every row, every stored invoice file, your subscription — permanently, in one action, no email thread required. Until then, every number you see traces back to the invoice that produced it. That's the deal.
We'd rather show you the mechanism than ask for your trust. Ask us anything.