Account and tenant boundaries
Seller identity is verified by the hosting platform. Every private request re-checks business membership on the server; hiding interface controls is never treated as authorization.
Public ordering
The server recalculates prices, checks deadlines, inventory, and pickup capacity, and uses idempotency keys to prevent duplicate submissions. Customer status links use random tokens rather than sequential IDs.
Data and operations
Secrets stay out of browser code and source control. Logs avoid customer contact details. Database migrations, backup guidance, dependency review, and an incident checklist are maintained with the product.
Report a concern
See support for the current pilot reporting path. No certification or compliance badge is claimed.