VendWiseSign in

How VendWise keeps your data safe

Last updated: 19 October 2026

Your sales, costs and payouts are private business information. This page explains, in plain words, how VendWise protects them. Every statement here describes what VendWise does today.

Your business is kept separate

  • Every record in VendWise belongs to one business. The database itself refuses to return one business's records to anyone signed in to another business (PostgreSQL row level security), so a mistake in the app cannot show your data to another vendor.
  • Every request to VendWise's server is checked against your sign in, and the business comes from your account, never from what the browser sends.
  • Automated tests try to reach each business's data from another business, for every part of the app, before any change goes live.

Signing in

  • You sign in with a one time code sent by SMS or email. VendWise has no passwords for anyone to steal.
  • Each request carries a short lived sign in token that is checked every time.
  • Owners choose what staff and accountants can see and do, and team changes are recorded.

Your Jumia account

  • VendWise never asks for your Jumia password.
  • You connect with a Client Id and Refresh Token from a Self Authorization app that you create in Jumia Vendor Center. You can switch it off there at any time.
  • The token is encrypted (AES-256-GCM) before it is stored, replaced every time it is used, and never sent to your browser or written to logs.
  • VendWise only reads from Jumia. It does not change your listings, prices or orders.

Your customers

Customer names, ID numbers, addresses and tracking codes are removed from Jumia files and API data before anything is saved. VendWise does not need them, so it does not keep them.

Payments

Payments are taken by Paystack. VendWise never sees your card number or Mobile Money PIN. Every payment is confirmed directly with Paystack by our server before your plan changes.

Encryption and hosting

  • Every connection to VendWise uses HTTPS (TLS).
  • Your data is stored with Supabase in Ireland (EU), encrypted at rest. The website and server run on Cloudflare.
  • Secret keys are kept in our hosting providers' secret stores, never in the app's code.

Crash reports and logs

Crash reports carry your user id only. Emails, phone numbers, IP addresses, cookies, sign in tokens and anything you typed are removed first. Logs never contain sign in codes or Jumia tokens.

If something goes wrong

If we learn that your data may have been exposed, we will stop the problem, find out what was affected, tell you quickly and tell the Data Protection Commission where the law requires it.

Reporting a security problem

If you find a security weakness, please email hello@vendwisegh.com with the details and do not share it publicly until we have fixed it. We will not take action against anyone who reports a problem in good faith and does not access other vendors' data.