GoWarehouse Security

Once a shipped order passes the number of days you set, the system processes the recipient’s name, phone number, address and email. You can choose partial masking, which keeps some information for customer service lookups, or full deletion.

Sensitive data such as two-step verification secrets and e-commerce platform authorization tokens is stored encrypted in the database.

Each client sees only its own products, orders and inventory. Warehouse staff can only access data belonging to their own warehouse organization, and organizations cannot access each other’s data. During development and testing, data queries are checked automatically to confirm the isolation conditions are applied.

Use roles or permission templates to set which features each person can see and which actions they can take.

Restricts the console to your company network. Anyone who needs to sign in from outside must give a reason, and the system keeps a record.

The system stores only the encrypted key, never the original. A key can be restricted to specific IP addresses, and regenerating a key invalidates the old one immediately.

Before an AI assistant can read warehouse data, the user must sign in and grant consent through the industry-standard OAuth authorization flow. Every change made by an AI assistant is labeled with its source in the audit trail.

GoWarehouse support can only enter your account to troubleshoot after you send an invitation. The authorization lasts 7 days and you can revoke it at any time. Each support session expires automatically after 45 minutes, and every entry and exit is logged.

Passwords are stored only after irreversible hashing. No one can see a user’s original password, including GoWarehouse engineers.

After 10 consecutive failed password attempts, the account is locked out for 15 minutes to stop automated password guessing. This applies to the console, the warehouse web app and the mobile app.

Supports one-time passcodes (OTP) from authenticator apps such as Google Authenticator, with 10 backup codes so you can still sign in if you lose your phone. Verification is paused for 15 minutes after 5 consecutive wrong codes, and a code cannot be used twice.

Sign in with your device’s own biometrics, such as a fingerprint or Face ID, or its screen lock, with no password to type. A passkey only works on the genuine GoWarehouse site, so a phishing site cannot obtain usable sign-in credentials.

A sign-in session expires after 3 days and is extended automatically with continued use, but the web app always requires a fresh sign-in after 30 days at most. Signing out also invalidates “Remember me” on all devices.

A warehouse account can be signed in to the web app on only one computer at a time. Signing in on another computer signs the first one out automatically. The same rule applies to the mobile app, and the web app and mobile app do not affect each other.

Every change to 16 document types, including orders and inbound receipts, records three things: who made it (a user, warehouse staff, an external integration or a scheduled job), where it came from (console, mobile app, API, AI assistant or import), and what changed.

Audit records can only be added, never edited or deleted, so any dispute can be traced in full.

All connections use HTTPS encryption.

Sign-in and authorization endpoints limit the number of attempts per minute. Common scanning behavior, such as attempts to read configuration files or look for admin interfaces, is rejected outright.

Pages can only load resources from approved sources. GoWarehouse pages cannot be embedded in other websites, which prevents fake pages from tricking users into clicking, and the system only accepts requests from GoWarehouse domains.

Every notification (webhook) GoWarehouse sends to your system carries a digital signature, so you can verify it really came from GoWarehouse and was not altered. Notification URLs that point to internal networks are rejected, so they cannot be used to reach internal systems.

The database is backed up automatically every day and can be restored if something goes wrong.

Database and server passwords are kept in Google Cloud’s secret management service and read only at deployment. They are never written into the code.

Automated tooling tracks new versions of the open-source packages the system uses and proposes upgrades as they are released.

The mobile app keeps its sign-in credentials in the operating system’s secure storage, such as iOS Keychain or Android Keystore. They are bound to the signed-in device and rotated automatically.

Warehouse staff can turn on fingerprint or Face ID sign-in for the app, so they don’t have to keep typing a password on the floor.

You can set how long the mobile app may sit idle before it requires signing in again, so no one else can simply pick up an unattended or lost phone and use it.