Security
How we protect your organisation's data. Everything below is implemented in the product today — described as how AdohPharma works, not as an audit or a certification. We hold no third-party security certification.
Data handling
Each organisation's data belongs to its own tenant, and every record carries that tenant, so one organisation's data is isolated from another's. Data is scoped by branch and role on top of that.
Offline data storage
When you work offline, sales and stock movements are stored locally on the device and queued. Each write carries a client-generated id so replays are de-duplicated when syncing — you never get a double-charged sale.
Role-based access
Access is enforced by role (Owner, Pharmacist, Assistant, Cashier). People only reach the screens and actions their role allows — a cashier is limited to the till, an owner sees reporting and settings.
Authentication
Accounts are protected by email-and-password sign-in, with optional two-factor authentication and Google sign-in. Protected routes require a valid session before any of your data is loaded.
Reporting a security issue
If you believe you have found a security vulnerability, please email security@adohpharma.com with the details. We do not claim any formal certification (such as SOC 2 or ISO 27001) — we will state clearly if and when that changes.