Security & data protection

Security at Medishelf is a design constraint, not a feature tier. Every plan — including Starter — gets the same isolation, encryption and logging. We follow a simple rule: collect only what the software needs, protect it in layers, and make it easy for you to take it with you.

Each pharmacy is a separate tenant. Products, batches, sales, customers and staff are stored with a tenant identifier, and every database query is scoped to the signed-in user's tenant before it runs. One pharmacy cannot read, list or modify another's data — not through the interface, the API, or search.

Multi-store accounts on Growth and Enterprise share a tenant across their own stores only, with per-store permissions for staff.

• Rate-limited logins — repeated failed attempts are throttled to block password guessing.
• Role-based access control — owners decide who can sell, receive stock, change prices or view profit.
• Self-service password reset through time-limited, single-use email links.
• Single sign-on (SSO) is available on Enterprise plans.
• Suspicious-login monitoring — we notify the account owner of unusual patterns we detect.

• Every API request is validated against a strict schema before it reaches business logic.
• Public endpoints are rate-limited to resist abuse and automated attacks.
• Stock changes run as atomic transactions, so concurrent sales can't corrupt counts.
• Dependencies are monitored for known vulnerabilities and patched as part of our weekly release cycle.
• Code changes are peer-reviewed before they ship to production.

If it changed, it's logged. Price edits, stock adjustments, voids, role changes and sign-ins are written to an audit log with the user, time and before/after values. Starter includes a basic audit log; Growth and Enterprise include the full log. Owners can review it at any time from the dashboard.

Data is backed up automatically, and backups are encrypted and stored separately from the primary database. We target 99.9% monthly uptime and announce planned maintenance in advance, scheduled outside typical pharmacy trading hours.

After cancellation, your data remains exportable for 30 days, is then deleted from production, and is removed from backups within 90 days. Details are in our Privacy Policy and Support & SLA page.

Access to production systems is limited to the engineers who need it to operate the service, and is reviewed regularly. Support staff only view customer data when you ask for help and only to the extent needed to resolve your request.

We use a small number of infrastructure vendors — hosting, email delivery and payment processing. Each receives only the data it needs and is bound by a data processing agreement. We never sell data or share it for advertising.

If we detect a security incident, we contain it first, then investigate. If your data is affected, we notify the account owner without undue delay — and within 72 hours of confirming a breach where the law requires it — with what happened, what data was involved, and what we're doing about it. A written post-incident summary follows once the investigation is complete.

• Give every staff member their own login — never share a cashier account.
• Use the least-privileged role that lets each person do their job.
• Remove staff access the day someone leaves.
• Use a unique, long password and a password manager.
• Review the audit log weekly for unexpected price or stock changes.

Found a security issue? Please email security@medishelf.co with steps to reproduce. We acknowledge reports within 2 business days, keep you updated while we fix it, and credit researchers who want recognition.