Security

What protects your laundry's data

How Toko Laundry keeps one company's data apart from another's, and what is not in place yet. Every line describes how the product works today.

Separation

Every query is scoped to one company

Each company is kept apart

Every database query that touches company data filters on the company, taken from your signed-in session. A test fails the build when a query does not. A member pinned to some branches is refused the others, whether they ask for a list or guess an identifier.
Where it runs

Toko Laundry is built to deploy as a Docker Swarm stack on Biwara's own infrastructure. The application, the realtime service and the website are separate services behind one HTTPS entry point that sets HSTS. The data is in PostgreSQL, and credentials are loaded as Docker secrets, not kept in files in the code.

Access

Roles decide what a person can do

There are five roles: owner, admin, cashier, production and courier. One table of capabilities decides what each may do, and the server checks it on every route; hiding a button is never the only gate. Salaries are visible to the owner alone, and platform administration is closed to every company.
Access ends when it should

Access tokens last 15 minutes. Suspending or re-scoping a member, changing a password, or deactivating a company ends the sessions it affects at once, not when the token would have expired. Refresh tokens rotate on every use, and replaying an old one ends the whole family, because a replay means a token was stolen.
Sign-in through Biwara

In production, staff sign in with Biwara Authentication. The sign-in is tied to the browser that started it, Toko Laundry stores no password for those accounts, and signing out at Biwara ends the Toko Laundry session.
Secrets stay secret

Credentials are never written to logs: the code gives them a type that refuses to print itself. Values that must be stored, such as a payout bank account number or an invitation link, are encrypted under a key that belongs to the company, so one company's ciphertext does not open under another's.

Money and messages

Who holds the money in online payment

Customers pay by QRIS or a VA pay link, processed by the payment provider through Biwara's payment service. The balance is held there and the app asks it for the figure; Toko Laundry keeps no funds in its own database. A business is switched on only after a platform administrator approves its payout account, and a platform switch can turn online payment off while the owner can still withdraw. The payout account number is stored encrypted and shown by its last four digits. Refunds are made by the laundry by hand; the system never makes one.
WhatsApp runs in Wavely

WhatsApp messages and the customer conversation list live in Wavely. Every call to Wavely is stored in the same transaction as the change it reports and sent afterwards with an idempotency key, so a rolled-back order never reaches Wavely and a retry is never applied twice. Wavely's webhooks are verified by signature and applied once.

Records

A record of who did what

Part of the product records changes together with who made them: schedule changes, chat routing, branch counters, and sign-ins through Wavely and Biwara. Each record is written in the same transaction as the change, so a change that rolls back leaves no record.

We would rather say this than let you assume it.

No security certification. Toko Laundry holds none today.
No published backup and restore procedure with stated recovery times.
No alert rules exist yet, so nothing would reach a person: metrics are scraped and charted only.
One copy of each service, with no failover and no stated recovery time.
No audit record for every change. A member being created or re-roled, a price changing and an export are not recorded yet.
No sign-in against a company's own directory, such as SAML or OIDC per company.
No self-service export or erasure of personal data, and no stated hosting region.