Security
Your collection stays yours.
How we host, protect and control access to your data. If something here doesn’t answer your question, write to security@toile.me.
CertificationsWe list only what we hold, with the auditor and date. Status:To confirm
- Access by role
- Each person holds one or more roles: Design, Product, Buying, Sales, Commercial Ops, Finance, Founder or Admin. Screens show only the actions those roles can take, and the server checks the same rules on every request.
- Factory users
- Factory operators and viewers sign in to a separate portal. They see only the samples, orders and shipments you share with their factory.
- Approval gates
- No sample seal without a Buying-validated Cost Sheet; no production without an approved PPS and a Finance deposit. Gates are enforced on the server, not only in the interface.
- Accounts
- Sign-up is by invitation from an Admin. Password-reset and invite links work once and expire.
- Audit trail
- Each record keeps an activity feed of who changed what and when, including factory uploads.
- EncryptionTo confirm
- Traffic is encrypted in transit with TLS. Encryption at rest and key management are described here once confirmed with the hosting provider.
- Hosting and data locationTo confirm
- Region and data-residency options.
- Backups and recoveryTo confirm
- Backup frequency, retention and how we restore a workspace.
- Reporting a vulnerability
- Write to security@toile.me. We acknowledge every report and tell you when it is fixed.
Subprocessors
| Service | Purpose | When |
|---|---|---|
| Google Cloud (Firebase) | Application, sign-in, documents and files | Always |
| Neon | Relational database: products, orders, contacts, stock | Always |
| Anthropic | Translating Italian Spec Sheet terms; the landing writing assistant | Spec Sheet terms only; the assistant only if switched on |
| Joor | Wholesale orders and linesheets | Only if connected |
| Shopify | DTC products and orders | Only if connected |
| Mattermost | Team notifications | Only if connected |
| FedEx, UPS | Shipping labels and tracking | Only if connected |
| Email delivery | Invites and password resets from toile.me | To confirm |