Separate, and secure

One store cannot see another. Not its products, not its prices, not its orders, not its people.

That is not a matter of careful configuration — it is enforced underneath everything, on every single read, by the storage layer itself rather than by application code that somebody has to remember to write. A new page cannot forget it, because a new page is not what enforces it.

What we never hold

• Card numbers. Turned into a one-time token in the shopper's browser and sent straight to the payment gateway. They never touch our servers and are not in our database.
• Your passwords. Stored as a one-way hash. Nobody at Bacon & Co can read one, and an admin resetting a password sets a new one rather than seeing the old.
• Real prices on an organisation-billed store. The shopper sees no price because there is no price to show them — the figure genuinely is not in the store.

Who can see what

Every screen answers to the same hierarchy: a shopper sees their own orders, a regional admin sees the people who report to them, a store admin sees the store. An export is built from a fresh read under your own permissions, so no selection or filter can pull something you were not already entitled to.

Actions we take on your behalf are recorded. When our support staff view a store as one of your people, that is written down and kept.