Your data is your business’s, and it is kept apart from everyone else’s.

Every record in Cultivar belongs to one business: its products, stock, orders, customers and suppliers. When the application reads or writes those records, it limits the request to the business that is signed in. If that limit is missing, the request is refused instead of being run without it. Automated tests check this on every change we propose.

A few jobs work across businesses on purpose, such as our staff tools and the timer that sends scheduled emails. Each one is marked in the code with a written reason.

A business with several locations keeps them under one sign-in. Each person sees only the locations they have been added to.

Start from one of four roles: admin, manager, staff or viewer. Then switch individual permissions on or off for each person: who can adjust stock, who can see cost and margin, who can send an email to customers, who can add or remove people.

Invitations are sent by email. The link is signed, works for 24 hours, and can be cancelled before it is used. Sending a new one cancels the old link. Remove someone and their access ends, including to your practice copy.

Each person signs in with their own email address and a password. Sign-in is handled by Supabase. Supabase states that it keeps a salted hash of each password, made with bcrypt, and not the password itself. Cultivar’s own database holds no passwords.

Every Cultivar app is served over HTTPS, so what you type travels encrypted between your device and us.

Drivers are not members of your team and cannot open your back office. The list of open orders shows the town, the delivery window and the total. It shows no name, phone number, email or street address. Those appear only for an order the driver has taken. Suspend a driver and their access ends on their next tap, not at the end of the day. When a driver closes their shift or signs out, the customer details held in the app on their phone are cleared.

People who work at Cultivar have their own kind of account. They are never members of your business. To help you, a member of staff opens a timed session into your account and must write down why. By default it can only look: the system refuses any change. A session that can make changes needs a separate permission and is shorter. Sessions end by themselves when idle.

• Look-only sessionsup to 60 minutes
• Sessions that can change thingsup to 30 minutes, with a reason
• Idle sessions endafter 15 minutes

Each session is recorded: who opened it, when, why, and any change made or refused during it. The record does not list each screen a member of staff looked at. It is kept even if a business’s account is deleted.

Staff cannot open a business’s practice copy, and a member of staff who leaves Cultivar loses every open session in the same step.

A menu email goes only to customers who agreed to marketing email. Every one carries an unsubscribe link that never expires and works in one click from the inbox. A spam complaint is treated as an unsubscribe. Order updates, such as “on the way”, are sent to the customer who placed the order and carry no offers. Cultivar does not send marketing by text message.

Emails sent through Cultivar record whether they were opened and which links were clicked.

Nothing leaves a practice copy. Emails and phone alerts raised there are shown to you in an outbox and are never sent, so you can train staff and test a menu email without reaching a single customer.

Cultivar does not process card payments. You can note that an order was paid by card, but no card number is entered or stored.

Cultivar runs on three companies’ services. What follows is what each one states about its own service. The certificates are theirs, not ours.

• Supabase holds the database and handles sign-in.Supabase states that all customer data is encrypted where it is stored (AES-256) and as it travels (TLS), and that it is SOC 2 Type 2 compliant. Supabase on security
• Vercel hosts the apps.Vercel states that data is encrypted in transit over HTTPS and at rest (AES-256), and that it holds a SOC 2 Type 2 attestation and an ISO 27001 certificate. Vercel on security
• Resend sends the email.Resend states that its datastores are encrypted at rest, that it uses TLS wherever data crosses a network, that the data it stores is held in the United States, and that it is SOC 2 Type II compliant. Resend on security

We keep the system. Who gets into your business is decided by you.

• Who you invite.An invitation gives a person a way into your business. Send it to an address you know is theirs.
• What each person can do.Give each person the role and permissions their job needs, and no more. Keep the number of admins small.
• Removing people who leave.Remove a team member, or suspend a driver, the day they stop working for you. Cultivar cannot know they have left.
• Passwords.One account for each person, never shared. A long password that is used nowhere else.
• Your phones and computers.Anyone who can open a signed-in device can do what its owner can. Lock screens, and sign out of shared machines.

If we learn that someone has reached your business’s data without permission, we will tell you without unreasonable delay, and in the way the law that applies requires. We will say what we know, what was affected and what we are doing about it, and we will update you as we learn more.

Your customers are yours. Where the law requires that they be told, that may be for you to do, and we will give you the facts you need to do it.

If you think you have found a security problem in Cultivar, tell us through the Contact page. Say what you found and how to see it again. We will reply, and we will tell you when it is fixed.

Research done in good faith is welcome. We do not intend to take legal action against anyone who follows these rules.

• Test only with an account that is yours, or in a practice copy.
• Do not open, change, copy or keep anyone else’s data. If you come across some, stop and tell us.
• Do not slow down or interrupt the service, and do not try to trick our staff or our customers.
• Give us a reasonable time to fix the problem before you tell anyone else about it.

We can speak only for Cultivar. We cannot give permission to test the companies we run on.

You should hear these from us.

• A second lock at the database.Today the separation between businesses is enforced by the application on every request. A second layer of the same rule inside the database has been written but is not switched on yet.
• An outside audit or certificate.Cultivar has not been audited by a third party and holds no security certification. The certificates named on this page belong to the companies we run on.
• Sign-in through another account.You sign in with an email address and a password. Signing in through Google, Microsoft or a company login is not built.
• An access log you can open yourself.We keep the record of our staff’s access. A screen for you to read it is not built yet.
• Reports to the state.Cultivar does not send anything to Metrc or any state system.
• A public status page.There is none yet.
• A reward for security reports.We read every report and reply. We do not pay for them.

Every change we propose is checked automatically. Hundreds of automated tests run on each one, including tests that one business cannot read another’s data. If an update to the database fails, the release stops and the version you were using keeps running.

See what shipped and when