Security & trust

Every request to swiftship.co.in, its subdomains, and the SwiftShip brand portal is served over HTTPS with TLS 1.2+ (TLS 1.3 preferred). We serve HTTP Strict-Transport-Security with a 2-year max-age and includeSubDomains; preload, so modern browsers refuse to connect to us over plain HTTP.

The app sets tight response headers on every page: X-Frame-Options: DENY (no clickjacking via iframe embedding), X-Content-Type-Options: nosniff, a restrictive Content-Security-Policy, a strict Referrer-Policy, and a Permissions-Policy that switches off unused browser capabilities.

The database is hosted on Lovable Cloud (managed Supabase / PostgreSQL). Volumes are encrypted at rest with AES-256 by the platform, backups are encrypted, and keys are managed by the platform provider. Object storage (proof-of-delivery photos, uploaded documents) is encrypted with the same standard.

Passwords are never stored in plaintext. Sign-in uses Supabase Auth, which hashes passwords with bcrypt and unique per-user salts — even SwiftShip staff cannot read a user's password. Signup and password changes are checked against the Have I Been Pwned breach corpus, so passwords known to be leaked elsewhere are refused.

Highly sensitive service credentials (Shopify OAuth tokens, webhook signing secrets, API keys) are stored in service-role-only tables and application-layer secret storage, never returned to the browser.

Every user-facing table has PostgreSQL Row-Level Security enabled with policies scoped to the signed-in user. In practice: a brand can only see its own orders, customers, inventory, invoices, and store connections. Warehouse staff see only the shipments assigned to their working warehouse. Drivers see only their own route. Enforcement runs inside the database — a bug in application code cannot bypass it.

Roles (admin, ops manager, SLA analyst, warehouse worker, driver, brand user) are stored in a separate user_roles table and checked by a SECURITY DEFINER function, so a compromised profile row cannot escalate privileges.

The public API (/api/public/brands/*) authenticates every request with a per-brand API key, validates payloads with strict schemas, and rejects unknown fields. Every outbound webhook we send is signed with HMAC-SHA256; every inbound Shopify webhook is verified against Shopify's HMAC signature before we act on it, using a timing-safe comparison so the signature cannot be brute-forced by measuring response times.

Shopify integrations use the modern OAuth flow with offline access tokens scoped to the minimum permissions we need — orders, products, inventory, fulfillments, locations, shipping and customers. GDPR mandatory webhooks (customer data request, customer redact, shop redact) are live and verified.

Privileged actions — user creation, role changes, exports, admin overrides, COD reconciliation, webhook signature failures — are recorded in a tamper-evident system_audit_log readable only by staff auditors. Failed sign-in attempts are recorded and repeated failures raise operational alerts.

Operational data (shipments, tracking history, PODs) is retained for as long as it is needed to support the brand's operations and to comply with tax and logistics record-keeping requirements. On a verified request from a brand or, for storefront-originated data, from the storefront (Shopify shop-redact and customer-redact webhooks), the corresponding records are deleted or anonymized within 30 days. See the Privacy Policy.

SwiftShip does not currently hold SOC 2, ISO 27001, PCI-DSS or HIPAA certification. We do not process card data — checkout and payment happen on your storefront (Shopify, WooCommerce, Wix), which owns PCI compliance for the transaction itself.

The most common way accounts get compromised is a reused or weak password. Please use a unique password for SwiftShip, turn on multi-factor authentication on your email account, and keep your brand API keys and webhook secrets on your server — never in browser code or a public git repository.

If you believe you have found a security issue, please email security@swiftship.co.in with a description and, if possible, steps to reproduce. Please do not publicly disclose the issue until we have had a reasonable opportunity to fix it. We aim to acknowledge reports within 2 business days.