Separate organisations
Access to products, supporting files and integration settings is limited to the signed-in organisation.
Security & data
Private working files stay private. You choose what goes into a published Passport.
Madeivo keeps the documents, integration credentials and internal records used to prepare a product separate from the information you choose to publish in its Passport.
How data is separated
Private work, connected systems and public product data stay separate.
Importing or editing a product does not publish its private working information.
Private workspace
Products, supporting documents and internal working records stay within the signed-in organisation.
Only intended information is published
Public Passports contain the product information selected for publication, not the private files used to prepare it.
Account protection
Passwords are hashed by the application and raw passwords are not stored.
Claims you can verify
We describe controls that exist today and avoid claiming certifications, uptime guarantees or security commitments that have not been established.
Built into the workflow
How Madeivo protects product information.
These controls describe how the service currently separates organisations, private documents, integration data and published Passport records.
Private supporting files
Supplier documents are not automatically exposed on a public Passport.
Secure passwords
Passwords are hashed by the application and raw passwords are not stored.
Reviewed information stays protected
Reviewed textile information cannot be changed silently after review.
Publication history
When a Passport is updated, earlier published versions remain part of its history.
Limited API access
API keys belong to one organisation and are limited to the permissions selected for that key. Plaintext API tokens are not kept after creation.
Signed webhooks
Webhook signing secrets are encrypted at rest. Delivery targets must be public HTTPS endpoints and webhook payloads are signed so receiving systems can verify them.
Commerce integration details
Shopify access and refresh tokens and WooCommerce REST API credentials are encrypted at rest. External product and variant IDs are kept as connector mappings rather than replacing Madeivo's own product identifiers.
Privacy-conscious analytics
Passport analytics stores aggregate activity rather than raw IP addresses, full user agents or persistent visitor identifiers.
Published branding stays unchanged
Branding is saved with each published Passport version, so later workspace changes do not alter an earlier release.
Only intended information is public
The public page contains the product information selected for the Passport, not private working files or integration credentials.
Private and public
A supplier document is not the public Passport.
Use private supplier documents and other sources to support the product record. Publish only the information that belongs on the Passport.
1 · Product information
Add what you know
Product details, materials, variants and identifiers stay together.
→
2 · Supporting documents
Keep the proof with it
Supplier documents can stay private while remaining connected to the product information they support.
→
3 · Public Passport
Publish what customers should see
Use one public QR link and update the Passport when product information changes.
Service safeguards
We only make security claims we can support.
We do not claim certifications, uptime commitments or controls that have not been established. Ask us about backups, retention, monitoring, incident response, subprocessors or service terms.
Security review
Have a specific requirement?
Tell us the control or requirement you need to check, and we'll confirm what Madeivo currently supports.
Ask about security →