THE STUFFS COMPANY / TRUST
Trust Center / Security
Security is part of the system.
We build and operate digital products with security practices suited to their architecture, data and operational context. These pages describe our current internal practices; they are not a certification or a guarantee of risk-free service.
Separate product data
Stuff OS, Ops Center, CRM and Stuffs Jobs are built as distinct products. Product deployments use independent databases where the product architecture calls for them, with APIs, webhooks and Edge Functions connecting defined workflows.
Separation reduces unnecessary coupling. It does not mean every environment or service is isolated in the same way; access and data flows depend on each product's configuration.
Access and RLS
For systems using row-level security (RLS), policies are reviewed with role- and user-based test cases. Automated checks and AI-assisted analysis can help identify edge cases, while a human reviewer evaluates the proposed policies and test results before approval.
RLS is one layer of access control. It complements application authorization, database permissions and careful handling of service credentials; it does not replace them.
Human review
All team members hold individual certifications related to ISO/IEC 27001, including an internal auditor who participates in review. These credentials belong to the individuals. The Stuffs Company does not claim that the organization, its products or its management system is ISO/IEC 27001 certified.
Questions
For general security questions, contact hello@thestuffs.company. For reporting a suspected vulnerability, follow Responsible Disclosure. Do not send credentials, personal data or exploit details by ordinary email.