Security
Your data, isolated and in your control
Stackroom is multi-tenant by design, with configurable roles and careful handling of your assets, people and history.
How does Stackroom keep our data secure?
Every organisation's data is isolated at the tenant boundary, access is governed by configurable roles and permissions stored in the database, and changes are audit-logged. Deletions are soft, so an accidental removal is recoverable from trash rather than gone. Authentication and rate limiting protect accounts and API keys.
Foundations
Built for accountability
Tenant isolation
Every organization's data is separated — your records are yours alone.
Configurable roles
DB-driven roles and permissions control who can view, assign and edit.
Access controls
Rate limiting and authentication protect your account and API.
Trash & recovery
Soft-delete with a trash bin means an accidental deletion is recoverable.
SSO/SAML and advanced enterprise controls are on the roadmap — talk to us about your requirements.
Permissions you configure, not tiers you pick
A technician who records handovers need not see finance fields, and a viewer can be genuinely read-only. Because roles are data rather than a fixed set of tiers, the awkward cases — a department admin, a read-only auditor — are configuration rather than a support ticket.
What each role can do. Assign roles from People → Access & roles.
| Permission | Viewer | Member | Manager | Admin | Owner |
|---|---|---|---|---|---|
View assets assets.view | |||||
Create assets assets.create | – | – | |||
Edit assets assets.edit | – | – | |||
Delete assets assets.delete | – | – | |||
Manage assignments assignments.manage | – | – | |||
Raise requests requests.create | – | ||||
Approve requests requests.approve | – | – | |||
Manage photos photos.manage | – | ||||
Manage folders categories.manage | – | – | – | ||
Manage locations locations.manage | – | – | – | ||
Manage people employees.manage | – | – | – | ||
View licenses licenses.view | – | – | |||
Manage licenses & see keys licenses.manage | – | – | |||
Manage settings settings.manage | – | – | – | – | |
Manage billing billing.manage | – | – | – | – |
Custom, per-organization roles are coming soon.
Every change, attributed and dated
Edits, handovers, returns, status changes and deletions are recorded with the person and the timestamp — including anything Stackroom AI does on someone’s behalf, attributed to it by name.
Deletion is a soft delete into a trash bin, so an accidental removal is recoverable. That matters more for assets than most records, because deleting one would otherwise destroy its whole history.
- Assigned · Checked out via Stackroom AI by R. Nayar2m ago
- Scanned · Level 2 · Desk 06 by R. Nayar18m ago
- Condition updated · good → fair by T. Weiss3h ago
- Status changed · available → assigned by R. Nayar1d ago
- Returned · Condition on return: good by J. Okafor2d ago
- Warranty renewed · ProSupport Plus → 2 Nov 2027 by A. Sharma5d ago
- Updated · Serial number, Location by M. Costa8d ago
- File attached · handover-receipt.pdf by R. Nayar12d ago
- File removed · old-warranty-scan.pdf by A. Sharma19d ago
- Sent for maintenance · Fan noise reported by T. Weiss26d ago
FAQ
Questions about security
Is our data separated from other customers?
Yes. Every query is scoped to the organisation, so records belonging to one tenant are not reachable from another. This is enforced in the data layer rather than only in the interface.
Can we control what each person can see and do?
Yes. Roles and their permissions are configurable rather than a fixed set of tiers, so a technician who records handovers need not see finance fields, and a viewer can be genuinely read-only.
Does Stackroom support SSO or SAML?
SSO and SAML are enterprise capabilities — talk to us about your identity requirements and what is available on your plan rather than assuming from this page, because the answer changes as they roll out.
What happens if something is deleted by mistake?
Deletion is a soft delete into a trash bin, so the record and its history can be restored. That matters more for assets than most objects, because deleting one would otherwise destroy its custody chain.
Ready to know where every asset is?
Start free — tag your first 100 assets and run a real checkout in your first session. No credit card required.