Security

Portcart Security

We take a layered approach to keeping operator and brand data safe.

Role-based access

Every admin user has a role: Super Admin, Admin, Content Manager, SEO Manager, or Viewer. Access scopes are enforced at the API layer, not just hidden in the UI.

Audit logs

Every admin action that changes data is logged with the actor, timestamp, and resource. The same applies to partner-portal users for brand and content changes.

Secure publishing

Draft and published versions are kept separate. Publish actions are logged and revertible. Versioning lets us roll forward and back without losing history.

Data separation

Each operator's arena data is logically separated. Multi-tenant tables include explicit operator scope columns and are queried with that scope on every read and write.

Encrypted transport

All public traffic is HTTPS with HSTS preload. Internal admin traffic between droplets uses private VPC networking, not the public internet.

Limited internal access

Access to production systems is restricted to a small operations team. SSH access is via key auth, not passwords. We rotate keys when team membership changes.

Backups

Database snapshots are taken regularly. Backups are encrypted at rest and stored in a separate region from the primary system.

Responsible disclosure

If you find a security issue, please email info@portcart.com with details. We aim to acknowledge within two working days.

What you should do

Use strong, unique passwords for admin accounts. Enable two-factor authentication when available. Don't share admin credentials. Notify us immediately if you suspect an account has been compromised.