SECURITY
Describe the controls. Be clear about the limits.
Implementation evidence is useful. It is not the same as a certification or a completed rollout review.
Public website
The static website serves local assets and is configured for HTTPS, a restrictive Content Security Policy, MIME-sniffing protection and framing restrictions. It has no login, file upload, payment form or Amazon OAuth callback.
Controls in the underlying product
- Amazon OAuth uses random, expiring state with atomic single-use consumption.
- Authorization state is bound to an organization, store and initiating user.
- A shared encryption service implements AES-256-GCM for protected credential values.
- Store operations include organization and store access checks.
These are code-level observations. They do not imply every dataset is encrypted or every endpoint has completed a tenant-isolation review.
Rollout requirements
Before public ERP onboarding, the operator must confirm the actual processor inventory, storage region, access policies, retention and deletion procedures, backup arrangements and incident-response responsibilities. Large Launcher does not claim SOC 2, ISO 27001, PCI certification or an independent security audit.
Report a concern
Email feedback@largelauncher.com with a minimal description and steps to reproduce. Do not include live credentials or personal information. An incident acknowledgement or resolution SLA has not been published.