Security at STOKK

Data is encrypted in transit with TLS. Sensitive credentials such as PINs and refresh tokens are hashed, never stored in plain text.

Owners sign in with their phone number and a 6-digit PIN, with a one-time SMS code to confirm a new phone. Staff join by scanning a QR code or opening an invite link, then use their own 4-digit PIN, which only works on phones paired to the business. Role-based permissions mean each person only sees what they should.

Your records live on your device first and sync securely to your account, so a lost connection never means a lost sale, or exposed data on a shared network.

Card payments are handled by PCI-DSS compliant partners. STOKK never sees or stores full card numbers.

Found a security issue? We appreciate responsible disclosure. Email [email protected] and we will respond promptly.