Security & payments
Security-first, by construction
Zappy treats every order as money in motion. Pricing is decided on the server, tenants are isolated, operations are idempotent, and payments run through providers that specialise in handling them.
Controls
What that means in practice
Server-authoritative pricing
Prices, discounts and totals are computed on the server from your rules and re-verified at payment capture. A modified client request cannot change what is charged.
Tenant isolation
Each business's catalogue, orders and customers are scoped to that tenant. Data does not cross the boundary.
Object-level authorization
Access is checked on the specific record, not just the route. Being signed in is not enough to read another tenant's order.
Idempotent operations
Order placement and payment use idempotency keys. A retry, a double tap or a dropped connection does not create a second order or a second charge.
Transactional inventory
Stock reservations and releases are atomic, so concurrent orders cannot oversell the same unit.
Audit trails
Changes to orders, pricing and fulfilment are recorded with actor, action and time.
Secure sessions
Sessions use signed, http-only cookies with sensible lifetimes. Credentials are never placed in URLs or logs.
Trusted payment providers
Card processing is handled by established payment providers. Zappy does not store raw card numbers.
What we do not claim
Zappy describes its architecture. It does not hold, and does not claim, SOC 2, PCI DSS, HIPAA or ISO certification. If your procurement process requires attestations or a security questionnaire, contact security@zappy.software and we'll tell you exactly what we can provide today.
Reporting a vulnerability
If you believe you've found a security issue in a Zappy property, email security@zappy.software with steps to reproduce. Please give us a reasonable window to respond before any public disclosure. We don't pursue good-faith researchers.
Bring your security questions to the demo.
We'll walk your team through the order and payment path in detail.