Private storage
Documents are stored in private Supabase Storage buckets. The storage path begins with the business identifier so access policies can scope files to that business.
Security
Your business record is separated from other business records.
The controls described here reflect the access policies in the ZimXPay database today.
Who can see records
An authenticated person with an active link to a business can read records for that business. Authorised ZimX platform team roles can access merchant records to deliver the service.
Row-level isolation
Row-level security is enabled on merchant-scoped tables. Read policies match each row's business identifier against the businesses linked to the signed-in person.
Scoped file access
Storage policies match the first folder in a file path to a business the signed-in person can access. Merchant document downloads are issued through short-lived signed links.
Important boundary: These policies substantiate access separation inside the application. They do not by themselves substantiate claims about encryption configuration, backups, retention periods, security certifications or a guaranteed incident-response time.