Data security
How your store's data is kept safe, and how we test the system
Every point on this page explains how we look after your shop's data and points to a real menu in the program that you can check yourself.
Each business's data is separated at the database level
Every table has rules enforced by the database so users see only the data of the business and branches they belong to, not just hidden by the app. Even if a screen has a bug, the database won't send out another business's data.
See it at: The rules live at the database layer (Row Level Security) on every table that holds business data
Individual accounts, not a shared password
Everyone has their own account. The owner can assign one of 6 roles and choose which branches each person sees when inviting them. Who can void bills, give discounts, view financial statements or edit payroll depends on the role, and the database checks permissions on every save.
See it at: Menu: System settings > Users & roles
An activity log of who did what and when
Creating, editing and voiding important documents is logged with the user's name and the time, and the owner can look back through it.
See it at: Menu: Audit log
Nightly backups and real restore drills
Business data is backed up automatically every night, and we have a procedure for testing restores from backup files on a test system, not just storing the files. Owners can download their own business's backup file.
See it at: Menu: System settings > Backup & restore
Automated financial checks every time the database changes
Every time we change the database, we run a suite of checks that the books still balance, stock still matches the accounts, amounts owed to trading partners match the accounts, and tax hasn't drifted, then compare the results with the previous run. Any failures are logged and tracked until fixed.
See it at: 272 checks as of 26 October 2026, growing with each new feature
Subscriptions are paid through Stripe, and we never store card numbers
Monthly or yearly subscription payments are made on Stripe's checkout page. Card details stay with Stripe, which meets the card industry's security standards, and never pass through our servers.
See it at: The checkout page opens at checkout.stripe.com
Encrypted connections, bot protection and 6-digit verification codes
Every connection uses HTTPS. Self sign-up accounts must confirm their email before first use. The sign-in, sign-up and forgot-password pages are protected by Cloudflare bot checks, which stop automated programs from guessing passwords. Business owners can set up a 6-digit verification code with an app on their phone, and once set, the system asks for the code every time you sign in.
See it at: Menu: System settings > Connections
Your data is yours, and you can download all of it
A backup file of your whole business can be downloaded from within the app, tax forms can be generated as files, and financial statements can be printed or saved as PDF. If you ever stop using us, your data isn't held hostage.
See it at: Menu: System settings > Backup & restore, plus the download buttons on report pages
Facts worth knowing
Stated in full so you can compare us with other providers directly.
- Works over the internet We recommend a mobile data backup at the store
- The database is in an AWS data centre in Australia, and data is encrypted both in transit and at rest.
- Business owners can switch on the 6-digit code themselves. It is not required yet, and we recommend turning it on from day one.
- A status check sends the team a summary every morning. There is no uptime figure guaranteed in the contract yet.
Frequently asked questions
Where is my data stored?
The database is in an AWS data center in Sydney, Australia, through the database provider Supabase. The website is served through Vercel, which handles connections from Thailand at its point of presence in Singapore. Data is not stored in Thailand. The list of related service providers and the countries where data is stored is disclosed on the data processing agreement page.
Can other stores see our data?
No. Each business's data is separated at the database layer. The database checks every time which business and branch a user belongs to, rather than just hiding it on screen.
Is my data encrypted?
Every connection to the website and app uses HTTPS, and data on the database disks is encrypted by the database provider.
How is data backed up?
The system backs up every night. Backup files are encrypted, and every night we test that they can actually be decrypted and used. We also rehearse restoring into a separate test system, and business owners can download all of their business data to keep for themselves under System settings > Backup & restore.
What if my password is leaked?
Business owners can set up a 6-digit verification code using an app on their phone. Once set, the system asks for this code every time you sign in, so someone who knows only the password can't get into the app. For now, it isn't required for every account. If you forget your password, click Forgot password on the sign-in page to get a reset link by email. If you don't receive the email, contact our team on LINE or by phone.
How much control do I have over staff permissions?
Each staff member has their own account. The owner can assign one of 6 roles: owner, manager, sales staff, warehouse staff, accountant and auditor, and choose which branches they can see when inviting them. The database checks permissions on every save, and an activity log records who did what and when. You can't yet fine-tune individual permissions for each person.
Can GORINY staff see my store's data?
Our policy is to access a business's data only when that business asks for help, and never to show one business's data to another under any circumstances.
Is my credit card information safe?
Subscription fees are paid on Stripe's checkout page, so card numbers never pass through our servers. Monthly plans are paid by card; annual plans by card or PromptPay.
What happens if there's a data breach?
We have a written incident response procedure. We will email the business owner within 24 hours of learning of an incident, with the information the business needs to notify the Personal Data Protection Committee within 72 hours.
If the internet goes down, can I still sell?
No. The app needs an internet connection while in use, and there is no offline sales mode yet. We recommend keeping a mobile data backup at the store.
What happens to my data if I cancel?
Your business can still view its data in read-only mode and download all of its data within 30 days after canceling. We delete the business's data from the system within 90 days, and older backup files that still contain that data rotate out within 6 months after that. The downloaded file is a data file for moving to another system. Tax reports can be downloaded as filing files, and financial statements can be printed or saved as PDF. There is no export-to-Excel button yet.
Does the system go down often? Is there a guarantee?
A status check sends the team a summary every morning. If something goes wrong, reach the team on LINE or by phone. There is no uptime figure guaranteed in the contract yet.
Do I need to install anything?
No installation is needed. You use it in a web browser. The service providers involved and the countries where data is stored are listed on the Data Processing Agreement page.
How does the AI assistant use my store's data?
The AI assistant and the summary cards on the app's home page send summary figures for your business to Anthropic for processing to generate answers. Under Anthropic's commercial terms of use, the data sent is not used to train models.
Who owns GORINY? Who is the owner and service provider?
GORINY Business Suite is operated by Mr. Nattanon Srimongkol, 187/2 Krungthep Kreetha 7 Road, Hua Mak, Bang Kapi, Bangkok. Phone 083-927-2676, email hello@goriny.com, LINE @791ibitd. Our team replies within 1 business day.
Can you issue a tax invoice for the subscription?
The price shown is the price you pay, with no VAT added. The program issues a receipt for the service fee. A tax invoice for the fee cannot be issued yet, because the provider is not yet VAT-registered.
More questions about security?
Ask us directly. We answer from what's real, not from marketing material.