How Wrapstart keeps every shop's data separate

Your data lives in PostgreSQL, the open-source database with decades of production use behind it. It enforces our sharing rules itself, so they hold no matter which screen or app a request comes from.

Every connection to Wrapstart's services is HTTPS, using TLS 1.2 or 1.3. Older, weaker versions of the protocol are refused.

Passwords are handled by a dedicated authentication service, never by our own code. You can turn on two-step sign-in with an authenticator app or a text-message code.

Sending a text, taking a payment, building a PDF or opening a file runs on our servers, which check who is asking before doing anything. The secret keys to our texting, email and payment providers stay there, never in the app on your phone or in your browser.

If you connect another system through the Wrapstart API, we store a one-way fingerprint of each key, not the key itself. We can check a key you present, but we couldn't read yours back if we tried.

PostgreSQL's row-level security is switched on for every table, and its rules let a person see only the rows of the shop they work for, within what their role allows. Because the rules live in the database, they apply to every screen, the phone app and anything else that asks.

Sending a text, charging a card, building a PDF or answering a phone call needs more reach than one person's sign-in, so these server functions don't lean on the row rules alone. Before they use any record or file a request names, they confirm it belongs to your shop. A record from another shop is treated as if it doesn't exist.

A job points at a customer, an invoice at a job, a message at a conversation. The database refuses a save from the app that would tie your work to another shop's record, so neither a slip in a screen nor a crafted request can stitch two shops together.

Photos, PDFs, call recordings and contracts are stored privately, in a folder that belongs to your shop. Before a file is read, copied or shared, our servers check that it sits in your shop's folder. Tricks that try to climb out of a folder (the old ../ kind, in any of its encoded spellings) are refused outright.

Some people work for more than one shop. Wrapstart keeps each shop's work apart for them too, so a person who moves between two teams never carries one shop's files or records into the other.

Each team member signs in with their own account, so nobody shares a login. Invitations go to their email and expire if they aren't used.

You decide what each role can do in each part of Wrapstart (customers, jobs, messages, the AI assistant and more), separately for viewing, creating and editing. The database enforces those choices, so a hidden button is never the only thing standing in the way.

Changing the shop's plan is reserved for the shop owner, and our servers check that on every request, not just in the menu.

If you want our help inside your account, you grant a support session from Settings: view only, or view and make changes, for 24 hours, 3 days or 7 days. You can revoke it at any moment, each session also ends on its own after 12 hours, every session is logged, and you're notified in the app when one starts and ends.

The files you keep in Wrapstart don't sit at public web addresses. They're private, and only our servers can hand one out, after the checks described above.

A quote, invoice or signing request opens a page made for that one document. If a quote or invoice link ends up somewhere it shouldn't, you can reset it and the old link stops working.

A file sent by text travels as a short, branded link. When someone taps it, Wrapstart checks the link, then creates a fresh key to the file that lasts ten minutes. The link in the message can stay useful for weeks while the key behind it lasts minutes, so a copied key is useless by tomorrow.

Short links are random ten-character codes. A mistyped code, an expired one and one that never existed all get the same page, so guessing tells an outsider nothing.

The signing certificate on an e-signed document records a SHA-256 fingerprint of both the original file and the signed one, so any later change to either can be detected.

When your customer pays a deposit or an invoice, they type their card into the payment processor's own secure fields: Stripe, Square, Clover or SumUp, whichever your shop uses. Our servers receive a one-time token for that payment, never the card number.

Each of those processors is certified to PCI DSS Level 1, the highest level of the card industry's security standard.

Before Wrapstart acts on a payment notice from Stripe, it checks Stripe's signature on it, so a forged "paid" message gets nowhere.

Checkout sells only the plans we actually offer, at their listed prices, and only the shop owner can change the plan.

When a customer texts STOP (or UNSUBSCRIBE, CANCEL, QUIT and the other usual words), Wrapstart marks them as opted out and won't text them until they text START again. Each opt-out and opt-in is recorded.

Marketing emails carry an unsubscribe link that takes effect straight away, and leaving your emails doesn't quietly change anyone's texting choice.

Incoming texts and calls are checked against our phone carrier's signature before Wrapstart acts on them, so nobody can slip a fake message into your inbox.

Mark a contact as "do not record" and no call with them is recorded or transcribed, in either direction, and the AI receptionist won't take their call. AI-voice calls follow the consent you've recorded for each contact: express consent for an informational call, written consent for anything that sells.

We recently finished a function-by-function review of how our servers decide which shop a request belongs to, and shipped the improvements in small batches, each reviewed and tested on its own.

Our shop-boundary checks started in watch mode: they recorded what they would have refused, without refusing anything, while we read the logs. Only when real use showed they would block nothing legitimate did we switch them on.

If one of those checks ever got in the way of real work, we can put it back into watch mode in about a minute, without shipping a new release.

Wrapstart carries more than 13,000 automated tests. The checks that guard shop boundaries have tests of their own that reach for another shop's data and confirm the door stays shut, and we deliberately break those checks to make sure the tests notice.

Changes to the database's structure and rules are written, reviewed and applied by a person, never pushed out automatically.