Security
How we protect your pharmacy's data. Everything below is implemented in the product today — described as how Pharma360 works, not as an audit or a certification. We hold no third-party security certification.
Data handling
Each pharmacy's data belongs to its own tenant, and every record carries that tenant, so one pharmacy's data is isolated from another's. Data is scoped by branch and role on top of that.
Offline data storage
When you work offline, sales and stock movements are stored locally on the device and queued. Each write carries a client-generated id so replays are de-duplicated when syncing — you never get a double-charged sale.
Role-based access
Access is enforced by role (Owner, Pharmacist, Assistant, Cashier). People only reach the screens and actions their role allows — a cashier is limited to the till, an owner sees reporting and settings.
Authentication
Accounts are protected by email-and-password sign-in, with optional two-factor authentication and Google sign-in. Protected routes require a valid session before any pharmacy data is loaded.
Reporting a security issue
If you believe you have found a security vulnerability, please email security@getpharma360.com with the details. We do not claim any formal certification (such as SOC 2 or ISO 27001) — we will state clearly if and when that changes.