Security for your NMS2S records.
Waputu keeps copies of the NMS2S records of New Mexico cannabis licensees. Each section below says what a protection is, what can go wrong without it, and what it means for your license, your NMS2S records, your customers’ data and your business.
Your own database
Each company gets a dedicated database that no other company uses.
Waputu sets up a separate database project for every customer. It holds your lots, rooms, potency, event history, products and labels, and no other company’s records.
When companies share one database, only the software keeps their records apart. One coding mistake can then show one company’s rows to another.
No other company’s records sit beside yours, so they cannot turn up in yours through a shared table. Each install has its own database password and its own database and encryption keys, so a database key for one install opens nothing in another.
Records the service copies from NMS2S using your credentials: inventory, rooms, potency and event history.
Records your team enters, such as products, labels, ingredients and nutrition information.
Waputu’s own signup and billing records live in a separate Waputu project. It holds none of your inventory.
You own your data. The Customer Agreement says that, as between you and Raiden, the records you enter and the records the service retrieves from NMS2S for you belong to you.
During your agreement you can export your data with the service’s export features. After it ends, a written request within thirty days gets you an export in a format Raiden chooses, if you have paid all amounts due.
Ending your agreement, deleting your install or exporting your data does not change any record in NMS2S.
Your own hosting
Your site runs as its own hosting project, at its own web address, with its own settings.
Each company gets a separate hosting project for its Waputu site, at an address of its own, such as yourcompany.waputu.com. The project holds that company’s settings and secret keys.
When companies share one hosting setup, one wrong setting, one stuck release or one leaked key can reach all of them at once.
Pausing, changing or repairing another company’s project does not touch yours, and the keys that open your database and protect your NMS2S token are made for your install alone.
Sign-in emails and redirects can point only to your install’s own web address.
The secret keys that belong to each install, including the one that protects your NMS2S token, are generated for that install alone and stored as sensitive settings in its hosting project. A few service keys, such as the one used to send email, are shared by all installs.
Browsers are told to use HTTPS only for the site and not to let other sites show its pages inside their own.
Stored in US West
Customer installations are stored with our database provider in the United States.
A new install is created in one place: its database in region us-west-1 (US West) and its site’s functions in region sfo1 (San Francisco). Setup refuses any other region and reads the result back to check it.
If you cannot say where your records are kept, you cannot answer a customer, an insurer or an auditor who asks.
You can give a straight answer about where your install lives. The Privacy Policy states the one limit on that answer.
Our service providers may process request information in other locations to deliver the service.
Sign-in protection
Accounts are by invitation. Administrators, and everyone while changes to NMS2S are on, need a second step.
Nobody can create an account alone. An administrator invites each person, and the invitation works once and expires after an hour. Administrators, and everyone else while changes to NMS2S are switched on, also enter a code from an authenticator app at sign-in, which is two-step sign-in.
A password alone can be guessed, reused from another site or talked out of someone. With it, a stranger could read your inventory, and could change records in NMS2S once changes are switched on.
Every change made in NMS2S through Waputu is made in your name and on your license, so who can sign in is your decision. Your administrators add and deactivate people.
Codes come from an authenticator app on the person’s phone. Text-message codes are not used.
The same two-step rule, for administrators and for everyone else while changes to NMS2S are switched on, is also enforced inside the database. A browser holding a sign-in that has not passed it cannot read or write records directly.
An administrator can reset a person’s two-step sign-in. The reset ends all of that person’s sessions first and leaves a record of who did it.
Our sign-in, signup and password recovery pages use Cloudflare Turnstile to check that a person is using the page.
A sign-in lasts at most 30 days, then the person signs in again.
The Billing page asks for a one-time code emailed to the owner or administrator who opens it. The code expires after ten minutes.
Before anyone reaches the dashboard they accept the current Terms of Service and Privacy Policy, and the install owner accepts the Customer Agreement for the company. Each acceptance is recorded with a time stamped by the database.
Your NMS2S credentials
The token that connects your install to NMS2S is handled as a secret from the moment it is pasted.
An administrator pastes a session token from a signed-in NMS2S session. Waputu does not ask for your NMS2S password. The token is checked, stored encrypted and never shown again.
That token can read your whole NMS2S record. Tokens leak when they are stored as plain text, written to logs or left on screen.
A copy of the database alone does not hold a usable token, and the controls in the next section decide what can be sent to NMS2S in your name.
The token is encrypted with AES-256-GCM before it is stored. The key is unique to your install and is kept in your hosting project’s settings, not in the database.
The NMS2S access token you provide is stored in encrypted form.
The token is never written to logs or shown on screen, and only the server can read the stored copy. A browser signed in as one of your users cannot.
Only an administrator can connect NMS2S or replace the token.
You are responsible for your NMS2S account, including rotating and revoking its credentials.
Every change to NMS2S
Every Waputu tool that changes NMS2S follows the same steps.
Changes go to NMS2S only as actions from a fixed list, and only after your administrator switches state changes on. Every attempt is recorded before it is sent.
A change in NMS2S is a change to your official record. A mistyped amount, a double click or a dropped connection can write the wrong thing, or write the same thing twice.
Your administrator decides when changes are on and can turn them off again. You can read what was sent, who sent it and what NMS2S answered. Waputu does not decide whether, when or how to take an action. Your users do.
Nothing is sent to NMS2S until your company’s administrator switches state changes on.
Switching state changes on needs a fresh confirmation from an administrator. The confirmation works once and only for ten minutes. Switching them off needs none.
Waputu can send NMS2S only the actions on a fixed list. Anything else is refused before a request is built, and the part of Waputu that reads from NMS2S cannot send a change at all.
Every action on an existing lot or manifest is checked against a fresh NMS2S read before it is sent.
Every attempt sent to NMS2S is recorded first. It keeps what was asked, who asked and what NMS2S answered.
Actions are recorded in an audit log: who took the action, when, what was requested and the result.
An action with an unclear answer is never sent again automatically. It is shown as unknown.
Some actions cannot be undone, including destruction, adjustments to zero and finalized manifests.
Who can see what
You decide who has an account. What Waputu staff can reach is described in the next section.
Your company has two roles. Administrators invite and deactivate people, connect NMS2S and switch state changes on or off. Other users do the daily work on lots.
If every account can do everything, one careless hire, one contractor or one former employee can read what you meant to keep private, or switch on changes to your official record.
You choose who is an administrator, and nobody can promote themselves. Only an administrator can change a role.
Records in your install, including the activity and audit records of your users, are available to your administrators.
The stored NMS2S token and the records of who accepted the legal documents can be read only by your install’s server, never by a browser.
Every table in the starting database of a new install has row-level security switched on.
Public lot pages are public on purpose. Anyone with the link or the QR code can open one without signing in. It shows product information your business supplied.
What Waputu staff can access
Our staff can reach your install. This section says when, why and how.
Waputu provisions, runs and updates your install, so some of our staff and contractors can reach it and the information in it.
Any company that runs software for you has some way in. If you do not know the rules for that way in, you cannot judge the risk.
You get the rules in writing, and the list below says exactly what the agreements allow and what access exists.
Our staff and contractors may access your install and the information in it to provide, maintain, update, secure and support the service.
The Customer Agreement adds the reasons, including provisioning, operating, monitoring, troubleshooting and supporting the service, releasing updates, investigating suspected misuse or security incidents, billing, and complying with law and legal process.
We run each install with the keys it needs, including its database key and our deployment access. Our agreements set the limits on staff access. There is no technical lock.
You do not get direct access to the accounts and infrastructure behind your install, or to the source code.
Service providers host the service, log requests, store data and send email for us: Vercel for hosting and request logs, Supabase for the database, sign-in and file storage, and Cloudflare for the human check.
Beyond our staff and those providers, we disclose information only as the Privacy Policy lists. That includes NMS2S when your users instruct an action, your administrators, a business transfer, your consent, and cases where the law, a subpoena, a court order, or a request or directive from the Division or another government authority requires it, or disclosure is needed to protect rights, property or safety.
Monitoring and alerts
Your install checks itself every ten minutes, and our operators are told when a check fails.
Every ten minutes your install runs health checks on its NMS2S connection and on unhandled server errors. When a check is confirmed as failing, an alert email goes to Waputu’s operators.
A dead NMS2S connection or a failing server can go unnoticed until someone needs a number that is out of date.
Problems get found without waiting for someone to complain. Alerts are informational, and the Customer Agreement leaves you responsible for monitoring your own install.
An alert says what failed and what the impact may be. It leaves out credentials, customer details, product records and raw request bodies.
Your administrators can see the state of the NMS2S connection in the app.
Backups
Our database host backs up each company’s database every day and keeps the last seven days.
Without a backup, a database that fails or is changed by mistake can lose records for good.
If a database is damaged or records are lost, there is a recent daily copy to restore from.
Point-in-time recovery is not switched on, so a restore returns the database to a daily backup, and changes made after it are lost.
Files stored outside the database, such as your company logo, are not part of that backup.
Our Customer Agreement does not promise how often backups run or how fast a restore happens.
Updates and testing
Every version is tested before it reaches an install, and checked again on each install afterwards.
Waputu is updated from one codebase. Every version must pass automated tests, type checks, code checks and a full production build before it goes to any install.
An update that skips testing can break everyone’s working day together.
A failed test or database step stops the rollout before any code is released. You cannot decline an update, because the Customer Agreement releases updates to all installs from one codebase.
Database changes reach Waputu’s own test install first, then customer installs one at a time, and stop at the first failure. The new code then goes to every install together, and each install is checked afterwards.
Once the new code is out, each install is checked: its deployment is ready, its health check answers, its sign-in page loads and its dashboard asks for a sign-in.
What we do not do
These come from the Privacy Policy and the Customer Agreement.
We do not sell, rent or share personal information or business data with anyone for money, advertising or marketing.
We do not use advertising cookies or third party analytics or advertising tools.
Cookies and browser storage are used to sign you in, keep you signed in, protect your account and run the features you use.
Raiden may use information about how the service runs, such as logs, performance data and usage statistics, to operate and improve it. The Customer Agreement says that information does not include your data in a form that identifies your company or any person.
Waputu does not start an action in NMS2S on its own. It acts on an instruction from your account, or to verify, reconcile or read the result of an action you instructed.
The service reads your records from NMS2S, and sends NMS2S the actions your users instruct.
We invoice customers. Customers pay by check, or by a bank transfer they start.
We do not accept payment cards, use a payment processor or debit customer bank accounts.
Origin and destination addresses go to a mapping provider, from our servers, when the service prepares directions for a manifest.
Our promises and their limits
Where your data includes personal identifying information of a New Mexico resident, Raiden agrees to keep reasonable security procedures and practices suited to that information.
If Raiden discovers a security breach of that information, it notifies you as the New Mexico Data Breach Notification Act requires. Notices to individuals and the attorney general stay with you.
No method of transmission or storage is completely secure, and we cannot guarantee security.
Raiden does not commit to any uptime, availability, response time, support level, backup frequency or recovery time unless an Order Form signed by both parties says so.
You are responsible for keeping your own copies of any data you need.
Your business is responsible for its own compliance, and for reviewing every label, nutrition facts panel, manifest and public page before it is used.
Nothing in Waputu is legal or regulatory advice, or a statement that any output complies with the law.
Security questions
Can another Waputu customer see my inventory?
No. Every company has its own database and its own hosting project, so no table holds two companies’ records. Each install also has its own database password and its own database and encryption keys, so a database key for one install opens nothing in another.
Can the Cannabis Control Division see my data in Waputu?
NMS2S is operated for the Division, so the Division already holds your NMS2S records. Waputu reads those records and sends NMS2S only the actions your users instruct. Raiden may also disclose your data when it believes in good faith that the law, a subpoena, a court order, or a request or directive from the Division or another government authority requires it, or that disclosure is needed to protect rights, property or safety. Otherwise we disclose information only as the Privacy Policy lists.
Does Waputu ever ask for my NMS2S password?
No. To connect, an administrator pastes a session token from a signed-in NMS2S session. The token is encrypted with a key that belongs to your install, it is never shown again, and it is not written to logs.
Who at Waputu can see my data?
Our staff and contractors may access your install and the information in it to provide, maintain, update, secure and support the service, and the Customer Agreement lists the reasons. We run installs with the keys they need, so our agreements set those limits. There is no technical lock.
Where is my data stored?
Customer installations are stored with our database provider in the United States. New installs are created in US West: the database in region us-west-1 and the site’s functions in region sfo1.
How do people sign in, and is two-step sign-in required?
People sign in with an account an administrator invited. Two-step sign-in with an authenticator app is required for every administrator, and for every other user while changes to NMS2S are switched on. The sign-in pages also use a human check.
Is my data backed up?
Your database is backed up daily. Our database host backs up each company’s database every day and keeps the last seven days. Point-in-time recovery is not switched on, so a restore returns the database to a daily backup, and changes made after it are lost. Files stored outside the database, such as your company logo, are not part of that backup. Our Customer Agreement does not promise how often backups run or how fast a restore happens, so keep your own copies of anything you need.
Does Waputu sell my data or use it for advertising?
No. We do not sell, rent or share personal information or business data with anyone for money, advertising or marketing, and we do not use advertising cookies or third party analytics or advertising tools. We use service data, such as logs and usage statistics, to run and improve the service. It does not include your data in a form that identifies your company or any person.
What happens to my data if I leave or my agreement ends?
Your official records stay in NMS2S, and ending the agreement does not change them. During your agreement you can export your data with the service’s export features. After it ends, a written request within thirty days gets you an export in a format Raiden chooses, if you have paid all amounts due. After that we may delete your install, so keep your own copies of anything you need.
What if Waputu goes away?
Your official records live in NMS2S, which is operated for the state’s Cannabis Control Division, so they do not depend on Waputu. The Customer Agreement makes no promise that Waputu will stay available, and it makes you responsible for your own copies of data you need, so export what matters while you can.
How do updates reach my install, and can one break it?
Every version must pass automated tests, type checks, code checks and a full production build. Database changes reach our own test install first, then customer installs one at a time, and stop at the first failure. The new code then goes to every install together, and each install is checked afterwards. We cannot promise an update will never cause a problem, and you cannot decline one.
Is Waputu completely secure?
No method of transmission or storage is completely secure, and we cannot guarantee security.