A friendly overview of what we store, what we don't store, how data flows through our system, and the partners who help us run the product.
These are the questions customers usually want answered first.
CoverPanda stores account, workspace, portal, file, report, payment metadata, integration, and operational records needed to run the product.
Full card numbers, CVCs, and full payer bank account numbers are entered through our payment provider's hosted flow and are not stored by CoverPanda.
When a customer connects QuickBooks, data moves through the QuickBooks API over HTTPS/TLS. CoverPanda stores server-side tokens, sync state, and monthly profit and loss and balance sheet reports needed for reporting.
Access is limited by authentication, organization membership, portal roles, workspace permissions, and limited CoverPanda support or engineering access.
CoverPanda is built for franchisors and their internal teams, bringing financial reporting, onboarding portals, payments, documents, tasks, and integrations into one place. Franchisees may participate through invited workflows, portals, payment requests, or shared reporting where the franchisor enables them. We use best‑in‑class managed services for specialized parts of the platform: hosting, identity, database, file storage, email, analytics, and payments.
API keys and webhook secrets live in environment variable stores, not in source code.
All traffic between users and CoverPanda is served over HTTPS/TLS. No exceptions, no fallback to plaintext.
Our managed data layer encrypts customer data at rest using 256‑bit AES. Our file storage provider documents in‑transit and at‑rest encryption for files.
User authentication is handled by our identity provider. The backend validates provider-issued session tokens before serving any protected data.
Access is scoped by authentication, organization membership, portal membership, and role‑based permissions, including external portal members.
Where integration credentials must be replayed, they're encrypted with AES‑256‑GCM using an environment‑managed key before storage.
Webhooks from external providers are verified using provider‑specific shared secrets or signatures wherever the provider supports it.
Customers authorize the QuickBooks connection. CoverPanda uses server-side tokens and API syncs, not emailed credentials, to retrieve monthly profit and loss and balance sheet reports.
CoverPanda payments use a hosted payment-provider flow. Payers enter card or bank details directly into the provider-hosted component. We store provider IDs, payment status, and limited receipt-style display metadata, not raw account numbers or security codes.
Our payment provider hosts the card and bank entry surface. We receive a tokenized session, then store status, amount, memo, provider IDs, method type, brand or bank name, expiration, and last four.
For merchant onboarding, we may store bank display metadata returned by our payment provider, including bank name, routing number, and deposit account last four. We do not store the full deposit account number.
Card and bank details are entered directly into our payment provider's hosted surface. CoverPanda stores payment status, provider IDs, and limited display metadata, not full card numbers, CVCs, or full payer bank account numbers.
The standard production data flow, high‑level enough to be readable and specific enough to show the major systems and trust boundaries. Customer‑specific integrations vary by workspace, so supporting providers are grouped by purpose below.
User browsers, the CoverPanda application, identity, payments, integrations, and operational providers, viewed from one altitude.
Raw card and bank details are entered directly into the provider-hosted flow. CoverPanda exchanges tokens with the provider, then stores status, provider IDs, and a small amount of display metadata.
Customer admins enter merchant and deposit account details into the provider‑hosted onboarding surface. We keep only display and routing metadata returned by the provider.
Not every workspace uses every integration category. This diagram groups supporting providers by function so the flow stays readable. A detailed vendor list can be shared separately when needed, and workspace-specific diagrams can remove unused integration categories.
This inventory summarizes the data categories CoverPanda handles. It is meant as a reference, so start with the overview and diagrams if you only need the big picture. Search by keyword or click a row to expand the details: example data, source, who it's shared with, who can access it, and how long we keep it.
Retention varies by data type, contract, legal requirements, and enabled modules. Operational records needed for financial, payment, audit, billing, tax, dispute, or legal purposes may be retained longer than general workspace content.
We group supporting providers by function in this public overview. A private provider appendix can be shared separately when exact vendor names are needed.