Security

Secure by design — and tested like it matters

Your shop runs on bikeryOS: money, customers, stock and fiscal records. So we don’t just claim it’s secure — we attack it ourselves, on the live system, and fix what we find. Here’s exactly how we test, what we test, and how the latest test went.

How we test

Real penetration testing, not a compliance checklist.

// 01 · Approach

We try to break in

We run structured penetration tests that probe the production system the way a real attacker would — chaining reconnaissance, authentication attacks and application abuse, not ticking boxes.

// 02 · Rules

Authorized and non-destructive

Every test is authorized and read-safe. We never damage data, disrupt a shop, or send real customer email — we prove a weakness exists, we don’t exploit it.

// 03 · Coverage

Multiple independent angles

Each test fans out across separate attack surfaces in parallel, each probed independently, so one blind spot doesn’t hide a whole class of issues.

// 04 · Fixes

Fix-forward, fast

Findings are triaged by severity and remediated quickly. In our most recent test, every fix shipped to production the same day and was re-verified live.

What we test

Four surfaces, covering the ways systems like ours actually get breached.

// 01 · Transport

Transport & encryption

TLS configuration (modern protocols and ciphers only, legacy ones rejected), certificate integrity, and the browser security headers — HSTS, a strict Content-Security-Policy, and clickjacking protection.

// 02 · Identity

Authentication & tenant isolation

Login and session security, resistance to token forgery, privilege escalation and account enumeration, that admin surfaces stay private — and, above all, that one shop can never reach another shop’s data.

// 03 · Application

Application layer

The web-application classics: open redirects, cross-origin abuse (CORS), information disclosure, secret and source leakage, insecure webhooks and unthrottled endpoints.

// 04 · Infrastructure

Infrastructure & mail

The server itself, not just the app — which ports are reachable from the internet (only the web and mail ports should be), SSH access hardening, and the inbound mail server tested against relay abuse and spraying.

Results

Continuous internal and independent testing.

Same-day

Remediation

Continuous

Adversarial testing

Re-verified

Every fix, live

We don’t wait for an annual audit. We run continuous internal adversarial testing alongside independent penetration tests, and triage every finding by severity. In our latest internal test, the critical and high-severity findings we uncovered were fixed and re-verified against the live system the same day, with lower-severity hardening tracked as follow-ups. The high-value controls held throughout — tenant isolation, admin lockdown, secret protection, encryption and session integrity. No security program is ever “finished”, which is exactly why we keep testing across every release.

Standing protections

Defence in depth, built in from day one — not bolted on.

// 01 · Hosting

EU hosting & data residency

Your data is hosted in the EU. Access to the platform is firewalled down to only what needs to be public.

// 02 · Isolation

Tenant isolation by design

Every request is scoped to your shop at the gateway and again at the database with Postgres row-level security — isolation is enforced in two independent layers.

// 03 · Encryption

Encryption in transit & at rest

Everything is served over modern TLS, and sensitive secrets — including fiscal signing credentials — are encrypted at rest with authenticated encryption.

// 04 · Fiscal

Fiscal-grade integrity

RKSV (Austria) and TSE (Germany) fiscal compliance, gap-free signed receipts, and an append-only audit trail that records who did what.

// 05 · Access

Hardened access

Brute-force protection on sign-in, a locked-down admin surface reachable only over private channels, and least-privilege permissions on every action.

// 06 · Web

Modern web defences

An enforced Content-Security-Policy with no unsafe inline scripts, HSTS, and a strict set of security headers on every page we serve.

Responsible disclosure

Found something? We want to hear it. We publish a security.txt with a monitored contact and welcome responsible disclosure — report it privately and we’ll work with you.