Security

1. Our Commitment to Security

At IndustryShop, the security of your data is fundamental to everything we build. We apply industry-standard practices across our infrastructure, applications, and operations to protect your information and maintain the integrity of our platform.

This page describes the technical and organisational measures we use to safeguard your data. For details on how we collect and use personal information, please see our Privacy Policy.

2. Infrastructure Security

Our platform runs on hardened, regularly patched infrastructure with defence-in-depth controls:

• Network isolation and firewalls between services
• Reverse-proxy and rate limiting to mitigate abuse and denial-of-service attempts
• Automated intrusion prevention (including IP banning for repeated failed access attempts)
• Continuous monitoring, logging, and alerting on critical systems

3. Data Encryption

We protect your data both in transit and at rest:

• All connections are encrypted using TLS (HTTPS) with modern cipher suites
• Sensitive data is encrypted at rest in our databases and object storage
• Secrets and credentials are managed centrally and never stored in source code

4. Authentication and Access Control

Identity and access are managed through a dedicated, industry-standard identity provider:

• OpenID Connect (OIDC) authentication backed by Keycloak
• Support for passwordless sign-in with passkeys (WebAuthn)
• Role-based access control to enforce least-privilege permissions
• Strict multi-tenant data isolation so each organisation's data remains separate
• Audit trails for sensitive operations and authentication events

5. Payment Security

We never store your full payment card details. All payments are processed through PCI-DSS compliant third-party providers (such as Stripe), so card data is handled directly by the payment processor under their certified security controls.

6. Application Security

Security is built into our development lifecycle:

• Input validation and protection against common web vulnerabilities
• Code review and automated checks before changes reach production
• Regular dependency updates to address known vulnerabilities
• Separation of development, staging, and production environments

7. Data Backup and Resilience

We maintain regular backups and recovery procedures to protect against data loss and to support business continuity. Our systems are designed to be resilient and to recover gracefully from failures.

8. Responsible Disclosure

We welcome reports from security researchers and the wider community. If you believe you have found a security vulnerability in our platform, please report it to us privately so we can investigate and address it. Do not publicly disclose the issue until we have had a reasonable opportunity to respond.

Please email security reports to [email protected] with details of the issue and steps to reproduce it. We appreciate your help in keeping IndustryShop and our users safe.

9. Your Role in Security

Security is a shared responsibility. You can help protect your account by:

• Using a strong, unique password or a passkey
• Keeping your devices and browsers up to date
• Being cautious of phishing emails and only logging in through official IndustryShop domains
• Reporting any suspicious activity on your account promptly

10. Contact Us

If you have questions about our security practices or wish to report a concern, please contact us:

• Email: [email protected]
• Website: industry.shop