Security
How we think about protecting your pharmacy's data. The items below describe product intent for this preview build — they are not certifications.
Data handling
Each pharmacy's data belongs to its own tenant, and every record carries that tenant, so one pharmacy's data is isolated from another's. Data is scoped by branch and role on top of that.
Offline data storage
When you work offline, sales and stock movements are stored locally on the device and queued. Each write carries a client-generated id so replays are de-duplicated when syncing — you never get a double-charged sale.
Role-based access
Access is enforced by role (Owner, Pharmacist, Assistant, Cashier). People only reach the screens and actions their role allows — a cashier is limited to the till, an owner sees reporting and settings.
Authentication
Accounts are protected by email-and-password authentication. Protected routes require a valid session before any pharmacy data is loaded.
Reporting a security issue
If you believe you have found a security vulnerability, please email security@getpharma360.com with the details. We do not claim any formal certification (such as SOC 2 or ISO 27001) — we will state clearly if and when that changes.