How Kestrel protects warehouse and client data.

Warehouse data isolation

Kestrel runs many warehouses on one platform. This is how each warehouse's data is kept separate.

• Each warehouse's data is tagged with its account, and the API checks the signed-in account on every request before it reads or writes data.
• Your account and role come from server-controlled sign-in data that users cannot edit.
• Client portal users can reach only the client accounts they belong to. Their membership is checked on each request.
• Database constraints also prevent some records from being linked across warehouse accounts.
• Isolation between warehouses is enforced by the application. We do not rely on database row-level security for it.

Support access

• Kestrel platform staff can open a warehouse account only through an explicit support session.
• Support sessions are read-only unless staff deliberately take control, and they are recorded in the audit log.

Role-based access

• Five built-in roles: platform owner, warehouse admin, warehouse staff, client admin, and client staff.
• Roles are checked on the server for every API endpoint. Automated tests flag any new endpoint that ships without a role rule.
• Sign-in is handled by Supabase Auth. Kestrel does not store passwords.

Credential storage and redaction

• ShipStation, QuickBooks Online, and carrier credentials are stored in Supabase Vault. The application database holds only a reference, and credentials are not returned to the browser.
• Partner API keys are stored only as SHA-256 hashes. The full key is shown once, when it is created, and cannot be retrieved later.
• API keys can be revoked, set to expire, and rate-limited.
• Outbound webhooks are signed with HMAC-SHA256. Inbound ShipStation webhooks are verified with a secret unique to each warehouse account.
• Error details written to our logs are scrubbed of recognized tokens, passwords, and API keys.

Audit trails

• Sensitive actions are recorded in an audit log, including API key, integration, and user changes, support sessions, order status changes, and inventory adjustments.
• Warehouse admins can review their own account's audit log.

Hosting and monitoring

• Kestrel is hosted in the United States: the application on Google Cloud (us-central1), the web front end on Vercel, and the database and sign-in on Supabase.
• Connections between your browser and Kestrel use HTTPS.
• Application errors are captured and grouped by Google Cloud Error Reporting.