Security
Practical security for pharmacy data.
Pharmacy data is sensitive. RunMyPharmacy is built on a security-first architecture with multi-tenant isolation, encrypted HTTPS connections, hashed passwords and role-based access protecting every account.
Security features built into every account
JWT authentication
Stateless token-based authentication with secure signing. Tokens are validated on every API request.
Multi-tenant data isolation
Every record belongs to a single pharmacy account, and every query is scoped to the signed-in user's pharmacy. No account can read another account's data.
Role-based access control
Five distinct roles (Admin, Manager, Pharmacist, Cashier, Doctor) with enforced permission boundaries at both UI and API level.
Hashed passwords
Passwords are hashed with bcrypt before they are stored. Nobody, including our team, can read your password.
Encrypted data in transit
All data between your browser and the RunMyPharmacy servers is encrypted using TLS. No plain-text transmission.
User attribution
Every sale records the staff member who completed it, and shelf actions are written to a shelf audit log with a timestamp and user.
Security combined with granular access control
Security at the infrastructure level works alongside role-based access control to give every team member only the access they need. Read the privacy policy to understand how your data is handled and stored.
How every request to RunMyPharmacy is protected
Security is applied in layers. Each request from your browser passes through all of them before any pharmacy data is returned.
Encrypted connection
All traffic uses HTTPS, and browsers are told to always use HTTPS for the site (HSTS).
Authenticated user
Each request carries a signed, short-lived access token. Expired or tampered tokens are rejected.
Scoped to your pharmacy
Data access is filtered by the signed-in user’s pharmacy, so one account can never read another’s records.
Checked against the user’s role
The API verifies the user’s role before sensitive actions, and request data is validated before it is saved.
What this means for your pharmacy
Passwords are never stored in plain text
Passwords are hashed with bcrypt, so even our team cannot read them.
Hardened by default
Standard security headers protect against common browser attacks such as clickjacking and content-type sniffing.
No shared logins
Every staff member has their own account, and every sale records who made it.
Least privilege for staff
Five roles limit each person to the parts of the system they need for their job.
Frequently asked questions
Can other pharmacies see my data?
No. Every record belongs to a single pharmacy account, and all data access is scoped to the signed-in user’s pharmacy.
How are passwords stored?
Passwords are hashed with bcrypt before storage. They are never stored or shown in plain text.
Is my connection encrypted?
Yes. RunMyPharmacy is served only over HTTPS, and HTTP requests are redirected to HTTPS.
Can I limit what each staff member can do?
Yes. Assign each user one of five roles: Admin, Manager, Pharmacist, Cashier or Doctor. Permissions are enforced by the API as well as the interface.
How do I report a security concern?
Contact our team through the contact page and we will respond as a priority.
More questions? Read the full FAQ or contact our team.
Keep reading
User Access Control
Role-based access for pharmacies: Admin, Manager, Pharmacist, Cashier and Doctor roles with enforced permissions that protect sensitive data.
Privacy Policy
How RunMyPharmacy collects, uses and protects pharmacy and customer data, and your rights as a user of our pharmacy software.
Terms of Service
The terms for using RunMyPharmacy pharmacy management software, POS system and online store: rules, responsibilities and limitations.
FAQ
Answers to common questions about RunMyPharmacy: pricing, setup, barcode scanning, inventory, prescriptions, security and data export.
Try RunMyPharmacy free
Full access to every feature during early access. No credit card required.