Security

How Tracvio keeps your data safe.

Protecting your business data is core to Tracvio. Here is an overview of the measures we take.

Encryption

All traffic to and from Tracvio is encrypted in transit using HTTPS/TLS — every till, phone and back-office screen. How passwords themselves are protected is set out under Access control below.

Access control

• Your data is yours. Your business figures — sales, purchases, expenses, profit and loss, payroll, customers — are visible only to the people you give a login to. Tracvio staff do not view or monitor your business data, and only access an account when you ask us for support, for that request only.
• Passwords are protected with industry-standard one-way cryptographic hashing. Nobody at Tracvio can read a password. If you forget one, it is reset, never revealed.
• Each store runs in its own isolated data scope, enforced on every request — a record belonging to another business cannot be opened from your store even by typing its address. Staff access inside your store is controlled entirely by the roles and permissions you configure.
• Sensitive actions (such as refunds, credit settlement or back-office access) can require a supervisor/manager PIN that you set.
• The things that matter are recorded and cannot be quietly undone: sign-ins, refunds and voids, stock movements and counts, and every use of a permission code — each stamped with who did it and when, and readable by you.
• Server and infrastructure access is restricted to authorised personnel, protected by key-based login and multi-factor authentication, and used only for maintenance, updates and backups — never to look at a customer’s business data.

Signing in

• Two-step sign-in is available on every account. Turn it on and, after your password, Tracvio asks for a six-digit code from an authenticator app on your phone. You are given ten recovery codes in case you lose the phone, and a store owner can require it for everyone in the store.
• Password guessing is blocked. Repeated failed attempts on an account are refused for a while, and every attempt — who, from where, and whether it worked — is recorded for you to read.
• Timed permission codes. Jobs you choose to lock — deleting records, posting a stock count, refunding a sale, changing a selling price — need a code the main admin issues for a set number of minutes and a set number of uses. The code is stored only as a one-way hash, and every use is recorded.

Reliability & backups

• The platform runs on managed cloud infrastructure with regular updates.
• Your point-of-sale keeps working offline during an outage and syncs securely when the connection returns.
• Data is backed up to support recovery.

Privacy by design

We collect only what we need, keep products isolated from one another, and follow the practices described in our Privacy Policy and Data Processing pages.

Reporting a vulnerability

If you believe you have found a security issue, please email support@tracvio.io with details. We appreciate responsible disclosure and will investigate promptly.