Scale
Every shop isolated, every action logged
Granular roles and permissions, an audit trail on meaningful changes, tenant isolation between shops, JWT authentication, rate limiting and HTTPS throughout, running on Redis, Horizon queues and Octane.
Roles & permissions
Roles & permissions
Granular permissions, not an all-or-nothing admin flag
Every role — manager, picker, report analyst and the rest — carries a specific permission set, checked on every API route, so a report analyst can read numbers without touching a price.
- Granular, role-based permissions, checked per route
- Roles scoped to a shop, marketplace or franchise as needed
- Sensitive actions — price edits, refunds — gated to specific roles
- A full audit trail records who did what, and when
Multi-tenancy
Multi-tenancy
One shop never sees another shop's data
Every query is scoped to the requesting shop. JWT authentication carries the session, and a token issued for one shop context cannot read another’s orders, customers or catalogue.
- Per-shop data isolation enforced at the query layer
- JWT authentication for session and API access
- A token scoped to one shop cannot reach another’s data
- Marketplace and franchise levels see only what their role permits
Infrastructure
Infrastructure
Redis, Horizon and Octane under the hood
Rate limiting protects the API from abuse, HTTPS is enforced throughout, Redis backs caching and sessions, Horizon runs background queues for imports and notifications, and Octane keeps the application server fast under load.
- Rate limiting on the API to prevent abuse
- HTTPS enforced across every endpoint
- Redis for caching and session storage
- Horizon queues and Octane for background jobs and throughput
Accountability
Accountability
A price change has a name and a timestamp
The audit trail records meaningful changes — a price edit, a permission grant, a manual wallet credit — with who made it and when, visible in the same reporting suite as everything else.
- Every meaningful change logged with actor and timestamp
- Price edits, permission grants and manual wallet actions all tracked
- Visible in the back-office reporting suite
- Supports investigating a dispute after the fact
Specification
Every detail, spelled out
Access control
- Roles
- Manager, junior product manager, delivery-guy manager, report analyst, picker, agent
- Permission model
- Spatie roles with per-route permission checks
Tenant isolation & auth
- Data isolation
- Per-shop, enforced at the query layer
- Authentication
- JWT for session and API access
Infrastructure
- Rate limiting
- Enforced on the API
- Transport
- HTTPS everywhere
- Caching & queues
- Redis, Horizon queues, Octane
Audit & compliance
- Audit trail
- Actor and timestamp on every meaningful change
- Activity log
- Part of the back-office reporting suite
FAQ
Questions about Security
Can one shop see another shop’s orders?
How are staff permissions enforced?
Is every price change logged?
What protects the API from abuse?
What runs the background jobs like bulk import?
Ask us about your compliance needs
We will walk through roles, isolation and audit logging with your team.
No card required · Live in a day · Support in Arabic and English