Weavery handles other people's orders, artwork and customers. Here is how the platform, and this site, are protected, in plain words.
How we think about it
Weavery sits between a shop's customers, its catalogue and the floor that makes and ships the goods. That makes it a system of record, and we treat it as one: the order that arrives is the order that gets made, every change is attributable to a person or an integration, and nothing moves halfway. Security is not a layer we add afterwards; it is why the platform is shaped the way it is.
UK hosted
Production runs in Amazon Web Services in the United Kingdom. Data does not leave the region to be processed.
Encrypted throughout
TLS on every connection, encryption at rest for databases, files and backups, managed keys.
Least privilege
Every action in the admin is permission-checked. Operators see their own organisation's orders and nothing else.
Accountable
An audit trail records who changed what and when, on orders, products and configuration alike.
Hosting and environments
Production runs in Amazon Web Services, in the London region, under an account that is used for nothing else. Development and user-acceptance environments are separate systems on separate networks; they never hold production data, and production credentials never leave production. Changes reach production only through the deployment pipeline, not from anyone's laptop.
Every connection to Weavery, whether from a browser, a storefront integration or a courier service, is encrypted with TLS. Databases, object storage and backups are encrypted at rest using AWS-managed keys. Backups are taken automatically and tested by restoring them.
Your data
Each organisation on Weavery, a shop or a fulfiller, is a tenant with its own boundary. A shop sees its own orders and products; a fulfiller sees only the jobs routed to it, and only the details it needs to make and dispatch them. Consumer data on an order (a name, a delivery address, a personalisation) is held for as long as the order needs it and the shop's retention rules allow, then deleted.
We are a processor for the data our customers put into the platform, acting on their instructions under a written agreement that meets UK GDPR Article 28. We do not use customer data to train models, and we never share it for anyone else's marketing. The privacy notice has the detail.
Access and accounts
- Multi-factor authentication. Weavery accounts can be protected with an authenticator app, and we ask every administrator to turn it on. Password resets are verified by email before a new password can be set, and then by the second factor where one is enrolled.
- Roles and permissions. What a user can see and do is determined by their role in their organisation, down to the individual action. Navigation, pages and API calls all check the same permissions.
- Sessions. Sessions expire, and signing out ends them everywhere.
- Integrations. Storefronts and couriers connect with scoped API keys that can be rotated and revoked at any time from the admin.
- Our own access. Nauni staff access production only for support and operations, from managed devices with disk encryption and multi-factor authentication, and that access is logged.
How we build
Weavery is built by a small senior team, and the process is deliberately plain. Every change is reviewed by someone other than its author and passes automated tests before it can be merged. Dependencies are pinned and updated on a schedule, with security advisories acted on as they arrive. Secrets live in a managed secret store, never in code. Infrastructure is defined as code and reviewed the same way.
Nauni maintains an information security programme covering the platform and the company: risk assessment, access control, supplier management, incident response and business continuity. The policies are available to customers on request, and we are happy to complete a security questionnaire as part of onboarding.
This website
weavery.co.uk is a set of static files. It sets no cookies, runs no analytics, loads nothing from third parties and is served only over HTTPS. There is no login on this site; the platform lives on its own domain.
Reporting a vulnerability
If you believe you have found a security issue in Weavery or this site, please tell us. Email hello@weavery.co.uk with "Security report" in the subject and as much detail as you can, including how to reproduce it. We will acknowledge your report within two working days, keep you informed while we fix it, and credit you if you would like us to.
Please give us reasonable time to fix an issue before disclosing it, test only against accounts you own, and do not access, change or delete anyone else's data. We will not take action against researchers who follow these rules in good faith. We do not currently run a paid bug bounty.
Questions
For anything else about security, data protection or compliance, write to hello@weavery.co.uk. If you are evaluating Weavery and need a completed questionnaire or a copy of a policy, say so and we will send it.