Security at ExpoDash

ExpoDash connects to your store, advertising, email and support accounts, so security is foundational, not a feature. This page summarises the controls we run. If you are a security researcher, see Reporting a vulnerability at the bottom.

Data protection

• Encrypted in transit. All traffic is served over HTTPS only, with HTTP Strict Transport Security (HSTS) pinning the browser to TLS.
• Encrypted at rest. The database is encrypted at rest, and the third-party access tokens and API keys you connect (store, ad, email and support platforms) are additionally sealed with authenticated AES-256-GCM encryption before they are stored.
• We never store card data. Payments run through our Merchant of Record, Paddle; card details stay with Paddle and never touch our servers.
• EU data residency.Our database and application run in the European Union (Frankfurt / Central EU regions).

Tenant isolation

Every customer is a separate tenant. Access to data is enforced in the database itself with PostgreSQL Row-Level Security, and again in the application's data-access layer, so one account can never read or write another account's data — even if a request reaches the wrong endpoint.

Access control

• Two-factor authentication (TOTP) is available to every account and is mandatory for administrative access.
• Sessions are protected with secure, HTTP-only cookies; changing your password revokes your other active sessions.
• Internal access follows least privilege, and privileged actions are recorded in an audit trail.

Application & platform hardening

• A Content-Security-Policy, secure response headers and strict input validation defend against injection and cross-site scripting.
• Abuse and brute-force attempts are throttled by durable, per-account and per-organisation rate limiting.
• Every code change runs through automated secret scanning and dependency vulnerability scanning before it can ship.
• We keep our framework and dependencies patched against known vulnerabilities on an ongoing basis.

Monitoring & recovery

• Security-relevant events (sign-in anomalies, credential changes, administrative actions, abuse) are logged and continuously scanned for anomalies, with automated alerting to our team.
• Customer data is backed up automatically, so we can recover from an incident.

Sub-processors

We rely on a small set of trusted providers to deliver the service: Supabase (database & auth), Vercel (application hosting), Paddle (payments), and Anthropic (AI). When you connect them, your data also flows to the platforms you choose — such as Shopify, Meta, Klaviyo, Google and your helpdesk provider — strictly to provide the features you use.

Reporting a vulnerability

We welcome reports from security researchers and will not pursue action against good-faith research. If you believe you have found a vulnerability, email info@expodash.io with details and steps to reproduce. Please give us reasonable time to remediate before any public disclosure, and do not access or modify other users' data. Our machine-readable policy is published at /.well-known/security.txt.

See also our Privacy Policy and Terms of Service.