Security Center
Your books, and who can reach them
Owwel holds your takings, your costs and your customers. This page sets out exactly how that is protected, in plain terms, including where the limits are.
Data encryption
Your data is encrypted both while it travels and while it sits on disk. Nothing is stored in plain text on a disk we control, and nothing crosses the network unencrypted.
- Traffic between your browser and Owwel is encrypted with TLS.
- Database contents are encrypted at rest by the hosting platform.
- File uploads are stored encrypted, and the vault that holds them is opened with a PIN that is salted and hashed rather than stored.
- Passwords are never stored. Only a one-way hash is kept, so nobody at Owwel can read or recover your password.
HTTPS everywhere
Owwel is served over HTTPS only. There is no unencrypted version of the app to fall back to, and requests arriving over plain HTTP are redirected before any page is served.
- Every page, API call and file download uses HTTPS.
- Session cookies are marked secure and http-only, so they are not readable by scripts on the page.
Encryption at rest
The database, its backups and uploaded files are all encrypted where they are stored, by the managed platform Owwel runs on.
- Disk-level encryption covers the live database and every backup taken from it.
- Uploaded documents are held in encrypted object storage, reachable only through short-lived signed links rather than public URLs.
Authentication
A correct password on an unfamiliar device is not enough on its own to get into your books.
- Signing in from a device Owwel has not seen before requires a one-time code sent to your email, even when the password is right.
- Devices you confirm are remembered, so the code is asked for on new devices rather than every time.
- Repeated failed attempts are throttled and locked out rather than allowed to run indefinitely.
- Staff sign in to their own portal with a personal PIN, which is hashed, attempt-limited and locks after repeated failures.
Role-based permissions
A cashier needs the till, not your margins. Access is granted feature by feature rather than as one blanket login.
- Each role is granted view, create, edit and delete separately, per feature.
- Cost prices and profit figures are their own permission, so someone can work a page without seeing what you paid or what you made.
- A member can be limited to only the records they entered themselves.
- Branch access is explicit: being on the team of one branch grants nothing on another.
Database isolation
Separation between businesses is enforced by the database itself, not by the application remembering to filter. A query that forgets a business filter returns nothing rather than somebody else's rows.
- Row-level security is enabled on every table that holds business data.
- Each policy checks the signed-in user against branch ownership or an explicit team membership before a single row is returned.
- The same rules apply to reads, writes, edits and deletes, so a gap cannot open on one of the four.
- This holds even if a bug reaches production: the database is the last line, and it does not depend on the code above it being correct.
Backups
The database is backed up automatically by the managed platform Owwel runs on, and those backups are encrypted like the live data.
- Backups run on an automatic schedule with no action needed from you.
- Backup copies are encrypted at rest.
- You can also take your own copy at any time: most lists export to CSV, and statements and reports export to PDF.
Monitoring
Errors are reported automatically so faults are found from the telemetry rather than from a customer noticing.
- Application errors are captured with the context needed to reproduce them.
- Failed sign-ins, lockouts and password changes are recorded.
- Monitoring covers whether the software is working. It is not a person watching a screen at 3am, and we do not claim otherwise.
Incident response
If something goes wrong that affects your data, you hear it from us.
- A suspected incident is triaged first for scope: what was reachable, by whom, and for how long.
- Containment comes before diagnosis. Access is cut or credentials rotated before anybody starts working out the cause.
- Report anything suspicious to info@owwel.com. Reports made in good faith are welcomed and will not be met with legal threats.
- Affected customers are told what happened, what was reached and what to do, rather than being left to read about it.
Account recovery
Losing a password should not mean losing your books, and recovering an account should not become a way in for somebody else.
- Password resets go to the email on the account and expire shortly after being issued.
- A reset link is single use and cannot be replayed.
- Owner accounts created by a system manager must replace the temporary password before anything else opens.
- Owwel staff cannot read your password, so recovery is always by reset rather than by being told what it was.
Session security
A session that lives forever is a key that never expires. Owwel's do not.
- Sessions expire on a fixed window and are enforced on every request, not left to the token to decide.
- A session that cannot be accounted for is treated as expired and sent back to sign-in.
- Signing out clears the session server-side, not only in the browser.
- Staff portal sessions are separate from owner and team sessions, so a shared shop tablet never carries an owner's access.
Audit logs
Who changed what, and when. Recorded by the database as the change happens rather than by the screen that made it, so it cannot be skipped.
- Inserts, edits and deletions on business records are logged automatically.
- Each entry keeps the actor, the time, the record and the action.
- Sign-ins, failed sign-ins and file downloads are recorded alongside record changes.
- The trail is written by database triggers, so a change made through any route is captured.
What Owwel does not claim
Owwel is not certified against SOC 2, ISO 27001 or PCI DSS, and does not hold itself out as being. The controls on this page are real and in the product today; a certification is a separate, audited thing and we will say so here on the day we have one. Card payments are not processed by Owwel, so no card numbers are stored anywhere in it.
Found something?
Tell us before you tell anyone else and we will fix it. Reports made in good faith are welcomed and will never be met with a legal threat.
info@owwel.com