ProCURE handles inventory, cost, and sales data for cannabis retailers, a regulated industry where a leak is legal exposure, not an apology. We built the platform to treat every retailer's data as isolated, encrypted, and recoverable from day one. This page is a plain-English account of how, and what's still ahead.
Everything in this section is in place today. Each control is verified in our code and infrastructure, and none of it is aspirational.
All traffic is served over TLS/HTTPS with HSTS enforced. Data is encrypted at rest in our database, and every backup is encrypted with AES-256 before it leaves our systems.
Each retailer's data is fenced from every other tenant. Isolation is enforced in the application layer and continuously verified by an automated cross-tenant test that runs in our pipeline, so a change that could leak data across tenants fails before it ships.
Access is role-based, and database permissions are locked down to only what each role needs. A guard on every sensitive action checks who you are and which tenant you belong to before returning a single row.
Encrypted backups run automatically every night and are copied to independent offsite storage. Recovery is not theoretical: we have restored a full backup end-to-end and verified every table matched, so we can bring your data back if the worst happens.
We watch the platform two ways. Application errors are captured the instant they happen, with personal data scrubbed out before anything is stored, and an independent outside-in check continuously verifies the site is reachable and alerts us if it goes down. We aim to find problems before you have to report them.
Every code change runs through automated checks before it can reach production: type-safety, a full test suite, and dependency vulnerability scanning. Known-vulnerable packages are flagged and patched on a schedule.
Inactive sessions end automatically after 30 minutes, with a warning first. Changing a password signs out every other session, and a removed teammate loses access on their very next request, because permissions are checked against the database every time.
ProCURE is a buyer-side analytics tool. It runs on product, cost, and sales data, not shoppers. Consumer personal information is actively stripped out at the point of upload before it is ever stored.
ProCURE runs on established, independently-audited infrastructure providers. We don't run our own datacenters. We build on vendors whose security is itself certified.
| Provider | What they do for us | Their compliance |
|---|---|---|
| Supabase Database & hosting | Stores your data (Postgres), authentication | SOC 2 Type II |
| Vercel Application hosting | Serves the ProCURE web app | SOC 2 Type II |
| Cloudflare DNS & offsite backups | Encrypted offsite backup storage (R2), DNS | SOC 2 Type II |
| Resend Transactional email | Sends account emails (invites, password resets) | SOC 2 Type II |
| Sentry Error monitoring | Captures application errors for diagnosis (personal data scrubbed) | SOC 2 Type II |
A current list of sub-processors is available on request, and material changes are reflected in our Privacy Policy.
We believe in telling you what's done and what's coming, honestly. Here's what's on the roadmap, in order.
We are preparing for a formal SOC 2 examination, beginning with Type I and moving into the Type II observation window. Enterprise buyers who require a report can reach out to discuss timing.
A third-party security firm will test the platform and we'll remediate findings on a published cadence.
For larger organizations that manage access through their own identity provider.
You own the data you put into ProCURE. We process it to run the analytics you asked for and nothing else. We don't sell it, and we don't share it across tenants. You can request an export or deletion of your data; how we handle retention and deletion is described in our Privacy Policy and Terms of Service.
We take security reports seriously and we won't pursue action against researchers who report in good faith. If you believe you've found a security issue, email us with the details and steps to reproduce, and give us a reasonable window to respond before public disclosure.