Your orders, customer data, and profits are strictly isolated and protected.
In Bangladeshi commerce, customer records and courier credentials are core business assets. Learn how BizTrackBD isolates multi-tenant records, encrypts API secrets with AES-256, and prevents internal staff data leaks.
Architectural Trust Pillars
Multi-Tenant Data Isolation
Every merchant account operates inside a strictly partitioned logical silo with database-level tenant isolation. A query executed by Store A can never access, read, or infer customer phone numbers, orders, revenue figures, or catalog data belonging to Store B.
Secret Vault for Courier & Gateway Credentials
Your Steadfast API keys, Pathao client secrets, bKash merchant credentials, and Meta Pixel access tokens are encrypted at rest using AES-256-GCM. Keys are decrypted exclusively in ephemeral serverless execution memory during dispatch requests and are never exposed in browser JavaScript.
Role-Based Staff Permissions & Phone Masking
Protect your customer database from internal theft. Assign custom roles (Manager, Dispatcher, Support, Packing Staff). Warehouse packing staff only see item lists and shipping barcode labels, while customer phone numbers and net profit figures remain masked.
High-Availability Edge Architecture & Backups
Storefronts run on globally distributed serverless edge infrastructure with automatic horizontal scaling. During high-traffic Eid campaigns or flash sales, traffic surges are absorbed without memory lockups or 502 errors.
Vulnerability Disclosure & Security Commitments
We treat the security of our platform with the utmost seriousness. Our security team regularly conducts automated vulnerability scans, dependency audits, and penetration tests across our edge network.
Security & Privacy FAQ
Common questions on merchant data ownership, backups, and encryption standards.
Can other merchants or BizTrackBD employees see my customer lists and order history?
No. BizTrackBD enforces strict multi-tenant isolation. Your database records are scoped to your unique tenant identifier. Furthermore, platform engineers operate under strict least-privilege policies and cannot inspect or export merchant business records without written authorization for support debugging.
How are my bKash merchant credentials and Pathao/Steadfast API keys kept secure?
All integration credentials are encrypted at rest using industry-standard AES-256-GCM encryption before being committed to our database. When an order is dispatched, credentials are decrypted in memory only for the duration of the API call to Steadfast or Pathao, and are never sent to the client browser.
How do you protect against staff stealing customer phone numbers?
BizTrackBD includes Role-Based Access Control (RBAC). You can create restricted accounts for dispatch staff, warehouse operators, and call agents. Restricted staff can print shipping labels and update order statuses, but customer phone numbers and financial profit ledgers can be masked to prevent database poaching.
What happens if a major power outage or server disaster occurs?
Our infrastructure includes automated continuous replication and daily off-site encrypted snapshots. In the event of a regional datacenter failure, systems failover to backup instances with a target Recovery Point Objective (RPO) of under 1 hour.
How do I report a security vulnerability?
We welcome responsible security research. If you discover a vulnerability or security flaw, please contact us immediately at security@biztrack.bd. We acknowledge reports within 24 hours and commit to rapid remediation under our responsible disclosure guidelines.