Soko ecosystem security

Auth runs through Supabase. Passwords are hashed with bcrypt and never exposed to Soko code. We support email + password and Google OAuth today; the same session works across every Soko product without re-entering credentials.

Sessions are managed via secure, HTTP-only cookies signed by Supabase. They're scoped to the Soko root domain so they're shared across every product subdomain — and only across those subdomains. Sessions refresh automatically; you can sign out from Account → Profile to end every session on the current device.

Every record in every product carries a tenant id. Reads and writes are scoped at the database layer through Supabase row-level security, so two tenants on the same database cannot see each other's data — even with a forged client request.

We never store card numbers, CVVs, or mobile-money PINs. Cards go through Marzpay's PCI-scoped hosted checkout. Mobile money runs as an STK push — you approve the charge on your own phone. The only payment data we hold is the gateway transaction id, amount, method, and status.

Frontend deployments run on Vercel with automatic TLS and edge DDoS protection. The database and storage run on Supabase (AWS eu-central-1). All traffic between Soko and our processors is HTTPS-encrypted.

Found something? Reach us at +256 778 087 986 on WhatsApp. We aim to acknowledge within 24 hours and patch critical issues within 72.