Protecting your data

• Invite-only — there is no public sign-up route.
• Email and password are handled by Supabase Auth, with passwords hashed using Argon2id.
• Time-based one-time password (TOTP) multi-factor authentication is available for every user and can be enforced per account.
• Session cookies are HttpOnly, Secure, and SameSite=Lax.
• Sign-in rate limiting is enforced at the identity layer to block credential-stuffing attempts.

• Role-based access control: each user is one of admin, owner, buyer, accounts payable, or viewer.
• Row-level security policies in Postgres enforce that a user can read only data belonging to their company. Admin users at Blue Sky Cashmere have access by virtue of their role; this is checked at the database, API, and page layers.
• Our staff (admins) cannot impersonate your users; all writes are attributed in the audit log.

• All traffic is served over TLS 1.2+ with HSTS. We do not accept unencrypted HTTP.
• Database storage is encrypted at rest with AES-256 by our infrastructure provider.
• File uploads (invoices, packing lists, certificates, message attachments) are held in private object storage. They are never publicly addressable — downloads are always served via short-lived signed URLs generated after an authorisation check.

• Every change to an order or a production stage is logged to an audit table, including the acting user, action, before/after values, and timestamp.
• Application errors are captured in real time and reviewed by our engineering team.
• Database backups are taken daily and retained according to our provider’s default policy.

If you believe you have found a vulnerability in the portal, please email security@blueskycashmere.trade with a description of the issue and steps to reproduce. We will acknowledge within two business days and do not pursue legal action against researchers acting in good faith.