Security
Secure by design — and tested like it matters
Your shop runs on bikeryOS: money, customers, stock and fiscal records. So we don’t just claim it’s secure — we attack it ourselves, on the live system, and fix what we find. Here’s exactly how we test, what we test, and how the latest test went.
How we test
Real penetration testing, not a compliance checklist.
// 01 · Approach
We try to break in
We run structured penetration tests that probe the production system the way a real attacker would — chaining reconnaissance, authentication attacks and application abuse, not ticking boxes.
// 02 · Rules
Authorized and non-destructive
Every test is authorized and read-safe. We never damage data, disrupt a shop, or send real customer email — we prove a weakness exists, we don’t exploit it.
// 03 · Coverage
Multiple independent angles
Each test fans out across separate attack surfaces in parallel, each probed independently, so one blind spot doesn’t hide a whole class of issues.
// 04 · Fixes
Fix-forward, fast
Findings are triaged by severity and remediated quickly. In our most recent test, every fix shipped to production the same day and was re-verified live.
What we test
Four surfaces, covering the ways systems like ours actually get breached.
// 01 · Transport
Transport & encryption
TLS configuration (modern protocols and ciphers only, legacy ones rejected), certificate integrity, and the browser security headers — HSTS, a strict Content-Security-Policy, and clickjacking protection.
// 02 · Identity
Authentication & tenant isolation
Login and session security, resistance to token forgery, privilege escalation and account enumeration, that admin surfaces stay private — and, above all, that one shop can never reach another shop’s data.
// 03 · Application
Application layer
The web-application classics: open redirects, cross-origin abuse (CORS), information disclosure, secret and source leakage, insecure webhooks and unthrottled endpoints.
// 04 · Infrastructure
Infrastructure & mail
The server itself, not just the app — which ports are reachable from the internet (only the web and mail ports should be), SSH access hardening, and the inbound mail server tested against relay abuse and spraying.
Results
Continuous internal and independent testing.
Remediation
Adversarial testing
Every fix, live
We don’t wait for an annual audit. We run continuous internal adversarial testing alongside independent penetration tests, and triage every finding by severity. In our latest internal test, the critical and high-severity findings we uncovered were fixed and re-verified against the live system the same day, with lower-severity hardening tracked as follow-ups. The high-value controls held throughout — tenant isolation, admin lockdown, secret protection, encryption and session integrity. No security program is ever “finished”, which is exactly why we keep testing across every release.
Standing protections
Defence in depth, built in from day one — not bolted on.
// 01 · Hosting
EU hosting & data residency
Your data is hosted in the EU. Access to the platform is firewalled down to only what needs to be public.
// 02 · Isolation
Tenant isolation by design
Every request is scoped to your shop at the gateway and again at the database with Postgres row-level security — isolation is enforced in two independent layers.
// 03 · Encryption
Encryption in transit & at rest
Everything is served over modern TLS, and sensitive secrets — including fiscal signing credentials — are encrypted at rest with authenticated encryption.
// 04 · Fiscal
Fiscal-grade integrity
RKSV (Austria) and TSE (Germany) fiscal compliance, gap-free signed receipts, and an append-only audit trail that records who did what.
// 05 · Access
Hardened access
Brute-force protection on sign-in, a locked-down admin surface reachable only over private channels, and least-privilege permissions on every action.
// 06 · Web
Modern web defences
An enforced Content-Security-Policy with no unsafe inline scripts, HSTS, and a strict set of security headers on every page we serve.
Responsible disclosure
Found something? We want to hear it. We publish a security.txt with a monitored contact and welcome responsible disclosure — report it privately and we’ll work with you.