Security Overview
Last updated: 19 July 2026
VendorStreet is an operating platform for farmers markets, experiences, and venues, operated by Ecropolis LLC. This page describes how we protect the data organizations and their customers entrust to it.
Our role
The organization is the data controller for its vendors’ and customers’ personal data; we are a processor acting on its instructions. We do not use that data for our own purposes, and we do not combine data across organizations.
See our Privacy Policy and Data Processing Addendum.
Data minimisation
We do not store payment card details or bank account numbers. Payment is collected on Stripe-hosted pages, and the Platform stores only Stripe identifiers, amounts, and statuses. The Platform has no fields for government identifiers of individuals or for special-category data.
Compliance documents uploaded by vendors (insurance certificates, permits) contain whatever their issuers put in them; they are stored privately and are accessible only within the owning organization.
Encryption and credentials
- All traffic is encrypted in transit using TLS.
- All data is encrypted at rest by Cloudflare.
- Passwords are stored as salted PBKDF2-SHA256 hashes (100,000 iterations); older hashes are upgraded to this scheme on the next successful sign-in.
- Platform API credentials (payment, email) are held as deployment secrets, not in code or in the database.
Authentication and sessions
- Sessions are held server-side and delivered as HttpOnly, Secure, SameSite cookies.
- A password reset revokes all of the account’s sessions; a password change revokes all but the current one.
- Sign-in, registration, and password-reset forms are protected by Cloudflare Turnstile and rate limiting.
Access control and isolation
Access is role-based: organization owners and admins, per-market managers, and vendor users each see only what their role allows. Every organization-owned record carries the organization’s identifier, queries are scoped to a single organization, and cross-organization isolation is covered by automated tests.
Internal access to production systems is limited to named personnel. Administrative actions on the platform side — including any support access to an organization’s account — are recorded in the audit log.
Payments
Payments run through Stripe. Webhook messages from Stripe are cryptographically verified before they are acted on, and payments that cannot be automatically reconciled are queued for manual review rather than silently dropped.
Auditability
Changes to organization data — vendor records, markets, bookings, billing, documents — are recorded in an audit log with the actor and the before/after state. Organization administrators can review this log for their own markets.
Data retention
Operational records are moved out of the live database on an automated daily schedule: audit events after 400 days, notification records after 180 days, resolved payment-reconciliation records after 90 days. Each archive is written to separate storage and verified readable before the original rows are removed, and a documented restore procedure exists for these archives. Abandoned draft bookings are deleted after 7 days.
Change management
Every change passes automated type checking, linting, and a test suite that runs against a real, fully migrated database before it can be merged. Database migrations are additive. Production, staging, and development use entirely separate databases, key-value stores, and file storage.
Business continuity
Data is held in Cloudflare’s managed, replicated storage. Retention archives are verified at write time and have a working restore script.
Sub-processors
| Sub-processor | Purpose |
|---|---|
| Cloudflare, Inc. | Application hosting, database, file storage, bot protection, AI features |
| Stripe, Inc. | Payment processing and billing |
| Twilio Inc. (SendGrid) | Transactional email delivery |
We notify organizations before adding a sub-processor.
Certifications
We do not currently hold SOC 2 or ISO 27001 certification, and we do not currently commission independent penetration testing. We are happy to answer security questionnaires directly — contact security@ecropolis.com.
Reporting a vulnerability
Email security@ecropolis.com with steps to reproduce. We aim to acknowledge within one business day. Please give us a reasonable opportunity to remediate before public disclosure. We will not pursue legal action for good-faith research that respects customer privacy and avoids service disruption.