Security posture
Security built for regulated fireworks commerce.
PyroApex documents what is built, what is in progress, and what still requires external audit. This page is written for wholesale buyers, brand owners, and operators doing vendor due diligence.
Database isolation
PostgreSQL Row-Level Security is enforced at the database layer, not only by application filters.
Payment scope
Card details are tokenized in the browser through ValorPay Passage.JS before checkout reaches PyroApex.
Audit readiness
Audit trails, change review, and deployment guards are active areas of platform hardening.
Controls by area
Status labels distinguish shipped controls from roadmap work. Certification claims stay off this page until an external audit exists.
Data isolation
BuiltTenant data is isolated with PostgreSQL Row-Level Security. Tenant tables force RLS, policies filter by the active tenant setting, and cross-tenant integration tests run in CI. See TENANT_SCOPING.md for the scoping model.
ReferenceEncryption
BuiltTraffic terminates through Caddy with automatic TLS, including on-demand TLS for verified tenant custom domains. Hosted PostgreSQL storage and DigitalOcean disks provide encryption at rest.
Authentication
BuiltStaff authentication uses WorkOS AuthKit. Storefront customers use magic-link authentication, and OAuth callbacks preserve tenant context across login and tenant switches.
Payment data scope
BuiltValorPay Passage.JS tokenizes card data directly in the browser. PyroApex receives a payment token rather than raw card numbers, minimizing PCI DSS exposure.
ReferenceBackups and recovery
In progressPer-tenant snapshot capture, self-serve restore, and row-level version history are in the 2026 roadmap. The pages will be updated with retention and recovery details after Cory verifies the final policy.
Audit trail
In progressChangeset review, price-list reassignment audit events, and database ownership guards are being built into operational workflows so sensitive changes leave reviewable evidence.
SOC 2 Type II
EvaluatingPyroApex does not claim SOC 2 certification today. The team is evaluating the Type II audit path for 2026 and will update this page when audit status changes.
Vulnerability reporting
BuiltSecurity reports can be sent to security@pyroapex.pro. Please include affected URL, reproduction steps, impact, and contact information for follow-up.
ReferenceNeed compliance details too?
The compliance page covers fireworks classification, age checks, resale certificates, certification gating, shipping, tax, SMS restrictions, and privacy links.