Trust, measured
Security and data: each shop isolated in the database
GrowMore keeps each shop’s books isolated inside the database itself, with row-level security enforced by the database engine, not only by the application. Posted entries are immutable, every agent proposal is logged with its original sentence, data is hosted in Europe, backups have a tested restore, and a shop’s data is exported as Excel or erased on request.
| When | Who | What |
|---|---|---|
| 10:42 | Claude, for the owner | proposed it from bought fifty Samsung A56 from Zain Trading at 210, credit |
| 10:42 | GrowMore | marked the currency and the lot assumed, please check |
| 11:05 | The accountant | approved it; it posted as PUR-00087 |
Can other shops see my data?
No. Each shop’s rows are isolated by row-level security that the database itself enforces, so even a mistake in the application cannot read another shop’s books.
Two separate database roles
One role owns and migrates the tables; the application connects as another. In PostgreSQL a table’s owner bypasses its own rules, so the application is never the owner.
A role that cannot bypass the rules
The application’s role is created without the right to bypass row-level security, and the stack refuses to start if that ever changes.
Row-level security forced on every table
Every accounting table carries the rule, forced, not only enabled. A request with no shop in its signed token sees zero rows, never all of them.
Seven isolation cases run against the real database for every table: the right shop, another shop, no shop at all, a shop that does not exist, a query that skips the application’s filters, a reused pooled connection, and an inventory of every table’s rule.
Where is my accounting data hosted?
On servers in Europe. Backups have a tested restore, and your whole shop exports as an Excel workbook whenever you want it.
What is in the audit log?
Every agent proposal is kept with the person’s original sentence, what the agent assumed and who approved it. Posted entries are never edited or deleted; a mistake is corrected by a linked opposite document.
How are backups done?
The databases are backed up, and the backups are restored into a separate server and the books of every shop are checked after the restore. A backup nobody has restored is not counted as one.
How do I delete my data?
Download your whole shop as an Excel workbook, then request the deletion of your shop. It is erased after the retention period stated in the privacy policy.
Agents, keys and passwords
- An agent posts only with the owner’s key for one document type, with a daily cap, revoked in one click.
- A connection never widens the person’s role, and it is checked again on every request.
- Passwords are stored as Argon2id hashes, never in a form that can be read back.
- Changing your password ends every other session.
Security questions
Where is my accounting data hosted?
On servers in Europe. Backups have a tested restore, and your whole shop exports as an Excel workbook whenever you want it.
Can other shops see my data?
No. Each shop’s rows are isolated by row-level security that the database itself enforces, so even a mistake in the application cannot read another shop’s books.
What is in the audit log?
Every agent proposal is kept with the person’s original sentence, what the agent assumed and who approved it. Posted entries are never edited or deleted; a mistake is corrected by a linked opposite document.
How are backups done?
The databases are backed up, and the backups are restored into a separate server and the books of every shop are checked after the restore. A backup nobody has restored is not counted as one.
How do I delete my data?
Download your whole shop as an Excel workbook, then request the deletion of your shop. It is erased after the retention period stated in the privacy policy.