We build Tokanza with care and state here what is actually implemented, without exaggeration. No system is 100% secure.
Measures in place
- Passwords: stored hashed with scrypt and a random per-password salt; we cannot read them.
- Store isolation: each store has its own database and upload folder, and one store cannot read another store's data.
- HTTPS: we require HTTPS in production and the Secure flag is set on session cookies. Session cookies are HttpOnly.
- Rate limiting: on sign-in, signup, newsletter and public endpoints to curb guessing and abuse.
- Backups: periodic backups of platform and store data.
- Payments: processed by Stripe; we do not store card details.
- Content handling: public HTML input is sanitised before display to prevent script injection.
Not available yet
- Two-factor authentication (2FA) for admin accounts is not currently available. We recommend a long, unique password.
- We do not currently advertise compliance certifications (such as SOC 2 or ISO 27001).
Reporting a vulnerability
If you find a security issue email support@tokanza.com with reproducible details. Please do not disclose it publicly before we fix it; we will not act against anyone who acts in good faith.
Incidents
If a breach affects your data we will notify you under the Data Processing Addendum.