Security
Your designs and data, protected
Unreleased products and supplier pricing are sensitive. Here's how we keep them safe.
Encrypted everywhere
All traffic to merchin.co is served over HTTPS (TLS). Data stored in our database and file storage is encrypted at rest by our infrastructure providers.
Strict data isolation
Row-level security policies are enforced inside the database on every table. Your organization can only ever read its own orders, files, and messages.
We never touch card numbers
Payments are processed by Stripe, a PCI DSS Level 1 certified provider. Card and bank details go directly to Stripe and are never stored on Merchin servers.
Secure authentication
Passwords are hashed and never stored in plain text. Accounts require email verification, and password resets use single-use, time-limited links.
Role-based access
Owners control who joins their organization and whether each person is an owner, manager, or read-only viewer.
Trusted infrastructure
Merchin runs on Vercel and Supabase, providers that maintain independent security certifications and operate on major cloud platforms.
Protecting your intellectual property
Your logos, artwork, and product designs are only shared with the manufacturers working on your order, and only to the extent needed to produce it. We never reuse your designs for other customers. If you need a signed NDA before sharing a new product, just ask.
Reporting a vulnerability
If you believe you've found a security issue in Merchin, please email security@merchin.co with details and steps to reproduce. We'll acknowledge your report promptly and keep you updated while we investigate. Please don't access other customers' data or disrupt the service while testing.