Security and control

Store data isolation

• Each store is stored in its own database and file folder, and never shares data tables with other stores.
• Every request to the system is checked: is the user still a member of that store, and do they have permission for that area?
• When a member is removed from a store, their sign-in session for that store is revoked immediately.

Role-based permissions

• Permissions are divided into 10 areas (overview, conversations, orders, customers, products and inventory, finance, marketing, AI, settings, members), each with 3 levels: None, View, Edit.
• New features are available only to the Store Owner by default, until they are assigned to a specific permission area. This prevents data from being exposed by oversight as new features are developed.
• Privilege escalation protection: members cannot create, assign or edit roles with higher permissions than their own, and cannot take any action affecting the Store Owner.
• Only the Store Owner can back up, restore, view the log and transfer ownership.

Accounts and sign-in

• Passwords must be at least 10 characters long and are hashed with the scrypt algorithm using a random salt. Lavix neither stores nor can read your original password.
• Sign-in is locked for 15 minutes after 8 consecutive failed attempts from the same address.
• Sign-in sessions use HttpOnly, SameSite cookies transmitted only over HTTPS, which expire after 7 days. You can sign out of all other devices in Settings → Account & Backup.
• Sign in with Google uses the OAuth 2.0 standard with PKCE and a single-use anti-forgery code (state). Lavix receives only your name, email and Google account identifier.
• Email verification: when you register, Lavix sends a 6-digit code to your email. Verification codes and password reset codes are stored only in one-way hashed form, expire after 30 minutes, can be used only once and are invalidated after 5 incorrect attempts. Resetting your password signs you out of all devices.
• No automatic account merging by email: if your Google email matches an existing Lavix account, you must enter that account's correct password before the accounts can be linked. This prevents attackers from taking over your account by registering first with your email.

Data protection

• All connections to lavix.io are encrypted with HTTPS/TLS.
• All platform and partner access keys (Meta Page, Messenger, advertising, Conversions API, Pancake, POS, carriers, Telegram, AI providers) are encrypted with AES-256-GCM at rest. Decryption keys are managed separately from the database. If the decryption key is missing, the system refuses to save rather than storing keys in plain text.
• Store backups are encrypted with AES-256-GCM using a password you set. Without that password, the backup file cannot be opened.
• Data restoration always checks the integrity of the file and automatically backs up the current state before replacing it.
• Details on the data we collect and how long we keep it are in the Privacy Policy.

AI under your control

• Only the data needed for the feature in use is sent to AI providers.
• Data received from Google at sign-in, passwords, access keys and bank account information are never sent to AI.
• Stores can turn AI features on or off, and set limits and approval requirements for actions proposed by AI.
• The list of AI providers and where processing takes place is published in the Subprocessors list.

Access by the Lavix team

Lavix staff do not access store data in the course of normal operations. When direct technical support is needed:

• A support session is opened with a single-use code that expires after 5 minutes if unused.
• Each support session ends automatically after a maximum of 2 hours.
• Throughout the session, the store sees an "Admin support session" notice on screen. The access is recorded in the store's change log.
• A support session cannot transfer ownership or leave the store on your behalf.

Infrastructure and operations

• Servers are located in Laos and Vietnam. Traffic passes through Cloudflare for protection against denial-of-service attacks and for load balancing.
• The system has two separate release channels: Stable and Canary. New features are tested on Canary first, and a store runs on exactly one channel at any given time.
• System administrators have encrypted tools to back up and restore the entire system.

Platform connections

• Lavix requests only the permissions required for the features you enable, and connects only the assets you actively choose.
• You can disconnect at any time, either in Lavix or directly on the platform. See the Data deletion instructions.

What you can do to stay safer

• Use a strong, unique password for Lavix, or sign in with Google.
• Do not share accounts. Invite each person to your store with their own account.
• Grant only the permissions each job requires, and remove members as soon as they leave.
• Review the change log regularly and download backups periodically.
• Lavix will never ask for your password or verification code by email, message or phone.

Reporting security vulnerabilities

If you discover a security vulnerability, please email [email protected] with a description, steps to reproduce and the expected impact. We will acknowledge receipt of your report within 3 business days and keep you updated on our progress.

When conducting your research, please:

• Do not access, modify or delete data that does not belong to you. Use only your own account and store for testing.
• Do not carry out denial-of-service attacks, send spam, or social-engineer Lavix staff or users.
• Give us a reasonable amount of time to fix the issue before disclosing any information.

Lavix will not take legal action against researchers who act in good faith and follow the principles above. We do not currently offer a paid bug bounty programme.

If an incident occurs

If a security incident affects data, we will contain and remediate it, notify the affected stores and the competent authorities in accordance with the law, and provide guidance on the protective steps required.