Security
Inventory is trust. StockZip is built with tenant isolation, role-based access, and complete audit trails so your team can move fast without losing confidence in your data.
StockZip runs on Supabase, which maintains SOC 2 Type II compliance for its infrastructure.
Hosted in reputable data centers with physical security, redundancy, and disaster recovery.
Automated daily backups with point-in-time recovery capability for disaster scenarios.
Every security feature is designed for small teams who need protection without complexity.
Tenant isolation enforced at the database layer. Every query is filtered to only return data belonging to your organization.
Admin, Manager, and Staff roles with granular permissions. Control who can edit inventory, manage settings, or delete items.
Every inventory change is logged with who, what, when, and why. Review the full history of any item or location.
TLS 1.2+ for data in transit, AES-256 for data at rest. Your inventory data is protected at every stage.
Restrict team members to specific warehouses or locations. They only see what you allow.
Export your data anytime as CSV. You own your data and can take it with you if you leave.
Control exactly what each team member can do. Default roles cover most use cases, and you can customize as needed.
| Action | Admin | Manager | Staff |
|---|---|---|---|
| View inventory | |||
| Edit item quantities | |||
| Create new items | |||
| Delete items | |||
| Manage locations | |||
| Manage team members | |||
| View audit trail | |||
| Export data |
Every inventory change is logged automatically. No guesswork when you need to answer "what happened?"
You should not need an IT team to run inventory securely. StockZip focuses on the basics that prevent real problems: tenant isolation, access control, and an audit trail your team can understand.
Common questions about scanning, offline mode, pricing, and migration.
StockZip uses strict database row-level security (RLS) enforced at the database layer, not just application logic. Each tenant can only access their own data, and this is enforced on every query.