Security & isolation
Isolation is an architectural choice, not a configuration flag
TradeWMS is delivered as dedicated customer instances. This page describes the controls that exist today — nothing here should be read as a certification claim.
Dedicated operational databases
Each customer instance holds its warehouse data in its own database. Customer operational records are not co-mingled in a shared pooled schema, so one customer's queries cannot reach another customer's rows.
Role and row-level controls
Inside an instance, access is enforced at the data layer with row-level security policies and role assignments stored separately from user profile data. Interface-level hiding is never the only control.
Auditability
Operational activity — receipts, movements, adjustments, fulfilment and shipping events — is recorded with the acting user and timestamp so a warehouse can reconstruct what happened.
Control-plane separation
Platform administration metadata (which instances exist, provisioning state, operator accounts) is kept in a separate control plane from warehouse operational data. Control-plane records are not warehouse records.
This public site is isolated
TradeWMS.com is a marketing and intake site only. Its backend contains a single lead-capture table and no inventory, orders, shipments, pallets, RMAs or customer operational data of any kind.
Compliance status
What we do not claim
TradeWMS does not hold SOC 2, ISO 27001 or any other security certification at this time, and publishes no uptime guarantee or availability certification.
We also make no claims about customer references, case studies or third-party audit results. If and when a formal audit or attestation is completed, it will be stated explicitly on this page with its scope and date.
This website's data
How early-access submissions are handled
The only data this public site collects is what you type into the early-access form.
- Early-access submissions are written through one controlled server-side path.
- Public visitors cannot read, change or delete lead records — the table exposes no public read access.
- Server-side validation checks email format and field lengths before anything is stored.
- Basic anti-abuse limits submissions per network per hour; only a salted hash of the requesting address is stored, never a raw address.
- No third-party email, CRM or analytics processor receives lead data at this stage.