Trust
Security at CBDPOS
Last updated: August 28, 2026
CBDPOS is a point-of-sale and storefront platform for hemp retailers, built and operated by Hammer Forge Apps LLC. This page describes, in plain terms, how we handle merchant and shopper data and how to report a security issue.
This page is an overview, not a certification or a contractual commitment. Our contractual security terms live in the Terms of Service and the Data Processing Addendum.
1. How we host the service
The platform runs on Railway in the United States (US East region). Each merchant store gets its own application instance and its own PostgreSQL database, so one store's order, customer, and product data is not stored in another store's database.
Storefronts, merchant admin panels, and the POS authenticate through Clerk, and administrative sessions are scoped to a single store. Platform payment credentials (Stripe) are held by Stripe; in-store card processing runs on the merchant's own Authorize.net account, and card data is tokenized in the browser and never touches CBDPOS servers.
2. Data we handle
- Store data: products, inventory, orders, customers, and store settings, stored in that store's own database
- Account data: names, emails, and role/PIN credentials for store staff, plus Clerk authentication records
- Shopper data on storefronts: contact and order details for fulfillment, processed on the merchant's behalf
- Billing data: subscription invoicing through Stripe; we do not store full card numbers
- Logs: operational logs for troubleshooting and compliance, retained and reviewed as needed
3. Engineering practices
- All database access is parameterized; user input is never interpolated into SQL
- Storefront page content and policy text are escaped at render time; merchant-authored content cannot inject scripts into shopper pages
- Secrets live in platform-managed environment variables, never in the repository
- Age verification (21+) and Minnesota hemp compliance checks are enforced on every storefront and POS sale
4. Reporting a vulnerability
If you believe you have found a security issue in CBDPOS, email [email protected] with details and steps to reproduce. We review every report and will keep you informed of our progress.
Please do not test against live stores or real customer data, and please give us a reasonable window to fix an issue before public disclosure. We do not currently run a bug bounty program.
For data privacy requests, use the contact information in our Privacy Policy.