Security

Tenant isolation

Every record that belongs to a customer carries its organisation, and the data layer applies that filter automatically rather than leaving it to each query. Brand users are scoped a second time, to their own brand, so one brand can never see another's claims even inside the same logistics provider.

Where we read live orders from a connected warehouse system, the read is scoped to the brand's own fulfilment client or sales channel. If we cannot establish that scope, the search is blocked rather than run wide. Failing closed is deliberate: an unscoped search across a shared warehouse tenant would expose one brand's orders to another.

Encryption

• All traffic is served over TLS, with HTTP Strict Transport Security enforced for a year.
• Data is encrypted at rest, including the database and uploaded evidence files.
• Warehouse system credentials are encrypted before they are stored and are never shown back in full.
• Card details never reach our servers. Payments run through our payment provider's hosted checkout.

Access and sessions

• Sessions end after 30 minutes of inactivity, and after 12 hours regardless of activity.
• High-impact actions require you to re-enter your password, and that confirmation lasts 5 minutes. It covers deleting a claim, changing a plan, issuing an interface key, and administrative access to another account.
• Roles are enforced on the server for every request. Hiding a button is never the control.
• Passwords are stored using a slow, salted hash. A new password is rejected if it is too short, too similar to your name or email address, entirely numeric, or on the list of the most common passwords. There is no character-class complexity rule and no live breach-database lookup, and we would rather say so than imply one.

The audit trail

Every meaningful action writes an audit event: status changes, decisions, comments, evidence added or removed, exports, administrative access. Those records cannot be edited or bulk deleted through the application. The code raises rather than allowing it. When an administrator acts while signed in as another user, the event records who was really behind the keyboard.

Incoming connections

Warehouse systems push despatch events to us. Each connection has its own secret, and each delivery is verified before it is read, using a signature over the raw body where the warehouse system supports signing, and a per-connection token where it does not. Deliveries that fail verification are rejected and recorded.

Our interface for developers

Keys are shown once, stored only as a hash, and can be revoked instantly. Requests are rate limited per key and failed authentication is throttled per address. A key grants access only to the organisation that issued it.

Retention

Mirrored order records are deleted after 180 days unless a claim is attached. Pack-station video is deleted 90 days after a claim is decided. Both run as scheduled jobs, so the limit is enforced rather than promised.

Reporting a vulnerability

If you believe you have found a security problem, email security@claimcore.co.uk with enough detail to reproduce it. We will acknowledge within two working days and keep you updated until it is resolved. Please give us a reasonable opportunity to fix the issue before making it public. We will not pursue legal action against researchers who act in good faith, avoid privacy violations and do not degrade the service.