Security
Built so a lost phone or a reused password can't expose your data
Separated at the database
Every record belongs to exactly one business. Row-level security in the database refuses requests for another business's data, and automated tests try to break that rule on every change.
Encrypted everywhere
HTTPS only (with HSTS), a strict content security policy, and encryption at rest for the database and file storage. Data is stored in Canada.
Strong sign-in
Invite-only accounts, 12-character minimum passwords checked against known breaches, two-factor codes required for owners and managers, recovery codes, and brute-force protection.
Sessions you control
See every device you're signed in on and sign them out. Shared devices sign out after 12 hours; any device signs out after inactivity. New-device sign-ins trigger an email.
Nothing silently lost
Stock movements and parcel events are append-only: they can't be edited or deleted, only reversed by a new entry. Every change is traced to a person and a time.
Audit log and consent-based support
Sign-ins, role changes, exports and support access are logged. Our support team can only enter your workspace if an owner switches on support access, and every visit is recorded.
Found a security issue? Email security@doodleinventory.com. We reply within two business days and won't pursue good-faith research.