Inventory system security checklist

• Every row is scoped by org and warehouse; roles limit who can approve spend, receive, adjust stock and override matches; pickers cannot see supplier prices or bank details.

• Segregation of duties across requester, approver, receiver and invoice matcher is enforced in the database and app; supplier bank changes require a second approver and open a payment hold.
• stock_moves, sent PO revisions, receipts and audit rows are insert only; corrections are reversing moves or new revisions with reasons.

• Supplier tax ids and bank details are encrypted at column level and masked in UI and logs.

• Alert on split POs just under an approval threshold, new supplier plus urgent bank change, receipts without POs, repeated adjustments by one user, and large write-offs.

• Delivery notes, invoices and photos are type- and size-validated, scanned and served by signed URLs; CSV imports neutralise formula cells on export.

• Procurement controls and SOX (applies to audited companies): Approval evidence, segregation of duties and three-way match are audited controls; the audit log and policy tables are the evidence.
• Public procurement rules (applies to public sector buyers): Government buyers must follow tender thresholds and publication rules; the app supports RFQ records but does not guarantee procurement-law compliance.
• Traceability regulations (applies to regulated goods): Food, pharma and medical products require lot tracking and recall readiness (for example FSMA 204, EU FMD).
• Customs and trade (applies to cross-border trade): Import/export documentation, HS codes and duties vary by country and are out of scope beyond storing codes.

• imports rows per day: per-tenant daily cap on imported rows; over the cap imports are refused.
• label pdfs per org month: capped PDF label renders per organisation per month.
• storage gb per org: per-tenant quota for scans and documents.

Forge64 gives every app its own Postgres database and runs a quality gate that flags unauthenticated writes and secrets in client code before you see the app. It does not replace your own testing, and it holds no third-party security certification today.

This is a reference design for the category, not a promise that every item is generated today. Built-ins such as background jobs, file uploads and search are rolling out; email sent from your app is coming soon, so anything here that needs it is something you add yourself for now.

• Sign in as two different users and try to open each other's records by changing the id in the address.
• Submit each form with an empty value, a very long value and a script tag, and check the result.
• Call each write endpoint without signing in and check that it refuses.

What is the biggest security risk in an inventory system?

Every row is scoped by org and warehouse; roles limit who can approve spend, receive, adjust stock and override matches; pickers cannot see supplier prices or bank details.

Does an inventory system have compliance obligations?

Procurement controls and SOX, if you have audited companies: Approval evidence, segregation of duties and three-way match are audited controls; the audit log and policy tables are the evidence. This is a starting point, not legal advice.

Will Forge64 certify my app as secure?

No. Forge64 holds no third-party security certification today and does not certify apps. The checklist is a way to test your own app.

• How to build an inventory system
• Inventory system architecture
• Example prompt for an inventory system
• Inventory system scaling checklist
• Often combined: online store
• Often combined: accounting system
• All app types