Security & trust
Built to protect the shop's operational data without hiding behind vague claims.
BayLineup uses layered application and infrastructure controls, keeps the public demo isolated from production, and publishes system status so customers can verify service health. We describe controls that exist today and do not claim certifications we have not earned.
Account protection
Passwords are hashed, sessions use secure HTTP-only cookies in production, sessions expire, and repeated failed sign-in attempts are limited.
Tenant-aware access
Organization-scoped workflows and permission checks are used to keep shop data and privileged actions inside the intended account boundary.
Protected integrations
Integration requests require secure URLs, signed webhooks are verified, replay/deduplication controls are used, and privileged integration actions require supervisor access.
Demo separation
The live demo uses fictional data and is explicitly prevented from running in the production application environment.
Abuse controls
Public submission endpoints are rate-limited, consequential actions are permission-aware, and sensitive operational paths are designed with auditability in mind.
Operational transparency
Customers can check the public system status page, review current integration availability, and contact support directly when something needs investigation.
Privacy and data handling
Our Privacy Policy explains how personal information is handled. Customer-facing links, permissions, operational history, and support workflows are designed to expose only the information needed for the task.
What we do not claim
BayLineup does not currently advertise SOC 2, ISO 27001, PCI DSS, HIPAA, or other third-party security certifications unless and until they are formally applicable and verified. Payment processing, when used, is handled through the configured payment provider rather than by asking shops to send card details through ordinary BayLineup forms.
Need a security review before buying?
We can answer technical and operational questions directly and provide the level of detail appropriate to your evaluation.