Encryption everywhere
Data is encrypted in transit with TLS and encrypted at rest in our databases and backups.
Security at Budfront
Your data, protected like our own
Dispensaries trust us with their menus, their customers and sensitive information like ID and medical card details. Here’s how we protect it.
How we keep data safe
Least-privilege access
Our team gets access only to the systems their role requires, protected by single sign-on and multi-factor authentication.
Staff permissions for your store
Give each of your team members only the access they need, and remove it instantly when someone leaves.
Audit logging
Orders, setting changes, verifications and admin actions are logged, so you can see who did what and when.
Backups & recovery
Store data is backed up automatically every day, with tested procedures to restore it.
Vendor review
We review the security practices of the providers we rely on before they handle customer data.
Sensitive information
Extra care for ID and medical card data
ID images and medical card details are among the most sensitive information a shopper shares. We treat them that way.
- Stored separately from general store data, with stricter access
- Visible only to staff roles that need to verify customers
- Retained only as long as your settings and legal requirements call for
- Never used for advertising and never sold
Data ownership
Your customers are yours
Dispensaries own their customer data. We process it to run your store on Budfront, and we never sell it or use it to market other dispensaries to your shoppers.
- Export your customer and order data at any time
- Clear data handling terms in your agreement
- Data deletion on request when you leave
If something goes wrong
- 1
Detect & contain
Monitoring and alerts help us spot unusual activity quickly, and we act to contain it.
- 2
Investigate
Our team works out what happened, what was affected and how to fix it.
- 3
Notify & improve
We notify affected customers as required by law and our agreements, then fix the root cause.
Responsible disclosure
Found a vulnerability? Tell us.
We welcome reports from security researchers. If you believe you’ve found a security issue in Budfront, please email security@example.com with the details and steps to reproduce it.
If you act in good faith, follow this policy and avoid harming our customers or their data, we won’t pursue legal action against you for your research, and we’ll work with you to understand and fix the issue.
Please do
- Give us reasonable time to fix the issue before sharing it publicly
- Use test accounts and only the minimum data needed to show the issue
- Include clear steps, affected URLs and your contact details
Please don’t
- Access, change or delete data that isn’t yours
- Run denial-of-service, spam or social engineering tests
- Test against live dispensary stores without permission
Security questions
Where is my data stored?
Budfront runs on established cloud infrastructure in the United States. Ask our team for details as part of your security review.
Can I get a copy of my data?
Yes. You can export your customer and order data from your dashboard at any time, or ask support for help.
Do you sell customer data?
No. We never sell dispensary or shopper data. See our privacy policy for how data is used.
Can you complete our security questionnaire?
Yes. Email security@example.com or ask your account team and we’ll help with your review.