How vkRetA approaches platform security

Protect account access

Public signup verifies the merchant email using a one-time code before account creation. Production sessions use secure host-only cookies, and sensitive account lifecycle actions invalidate relevant sessions.

Password reset, suspension, deletion and privilege-sensitive changes are handled as authentication lifecycle events rather than isolated screen actions.

Keep business data separated

Merchant APIs resolve the authenticated business and apply tenant checks before returning or changing business records. Super Admin operations use their own privileged access path.

Application, admin, setup and billing documents use a neutral no-index shell so a hard refresh does not expose unrelated marketing content.

Bound public and uploaded input

Request bodies, image formats, media quotas and storage paths are validated. Public order totals and coupon savings are recalculated on the server instead of trusting browser-submitted amounts.

• Email verification
• Secure session handling
• Tenant-protected routes
• Bounded uploads and server validation

How your account is protected

1. Email verification before an account exists

   Public signup sends a one-time code to the owner's email. No account is created until that code is verified, and signup also uses Cloudflare Turnstile human verification.

2. Passwords are stored as hashes

   Passwords are not stored in readable form. vkRetA stores a salted PBKDF2 hash and compares against it at sign-in.

3. Sessions stay in protected cookies

   Your signed-in session uses a cookie marked HttpOnly, Secure and SameSite=Strict, so page scripts cannot read it and other sites cannot send it with their requests.

4. Changes come only from the vkRetA workspace

   Requests that change data must come from vkRetA's own pages, and signup, sign-in and password reset attempts are rate limited to slow down repeated guessing.

5. Resetting a password ends old sessions

   Password reset and other account lifecycle changes sign out existing sessions for that user.

Safeguards inside the platform

• Business data stays with its business

  Every merchant request is tied to the signed-in business, and records belonging to another business are refused.

• Two-factor authentication for Super Admins

  Platform administrators must use an authenticator app (time-based codes) with recovery codes, and recent sign-in is required for sensitive administrative actions.

• Revocable staff billing links

  Staff billing links give limited billing access without sharing the owner's password, and the owner can revoke or regenerate them.

• Totals calculated on the server

  Order totals, coupon savings and payment allocations are recalculated on the server rather than trusted from the browser.

• Duplicate-safe payments

  Recording the same payment request twice does not record the payment twice.

• Bounded uploads

  Image formats, sizes and per-plan media storage are checked before files are stored.

What you can do

• Use a strong, unique password

  Do not reuse a password from another service for your vkRetA account.

• Never share codes

  vkRetA will never ask for your password or one-time code in a support message.

• Revoke links you no longer need

  Revoke a staff billing link when a staff member leaves or a link is shared by mistake.

Frequently asked questions

See how the workflow fits your business

Start on the Free plan, configure a real business workflow and upgrade only when the additional Pro capacity is useful.