SECURITY
Clear controls for the data you choose to use.
The CPG Shop separates browser-session work from saved account data and uses managed providers for identity, hosting, and private storage. This page describes the controls currently in place without promising that any online service is risk-free.
Effective October 2, 2026
Authentication
Google Identity handles password authentication and Sign in with Google. The CPG Shop does not store your password. A signed-in session is required before account-backed setup data can be read or changed.
Keep your account and email secure, use a unique password when signing in by email, and sign out on shared devices.
Account and workspace boundaries
Account-backed routes check the signed-in identity and company workspace before returning or changing saved brand details, logos, catalogs, mappings, remittance-category preferences, and related settings. Saved files are kept in private application storage rather than published as public site assets.
Remittance handling
Remittance files and the working check review are processed in the current browser session. Ordinary review does not upload the source file or create an account-backed check history.
Remembering a category for future checks requires a signed-in account. The saved preference contains the recognized distributor/code and selected category, not the source document, invoice details, or check amounts. Account-backed requests check the company workspace before reading or changing those preferences.
Purchase-order handling
The PO Converter is currently coming soon. The following explains its prior document handling.
Standard free PO conversion and review run in the current browser session. The source document is not added to the global training library simply because it was opened in the converter. To find an approved template, the converter checks the customer name and document-layout identifier; it does not upload the PDF or its line-item contents for that lookup.
A separate, access-controlled owner/admin template-training workflow can retain source documents, extracted data, and approved corrections that are explicitly submitted for training. Keeping that workflow separate prevents ordinary converter use from silently becoming training data.
Working drafts and exports
Calculator and planning drafts are session-only unless the product expressly identifies a saved account feature. Exports are copies created for you to download; exporting does not create an editable saved plan. Review generated spreadsheets, PDFs, and system-import files before relying on or uploading them elsewhere.
Responsible use
- Upload only information you are authorized to use.
- Do not share passwords, authentication codes, or sensitive credentials with support.
- Review source mappings, totals, and exports before releasing them to another system.
- Tell us promptly if you believe your account or business data was accessed improperly.
Report a security concern
Email support@thecpgshop.com with a clear description of the issue and how to reproduce it. Do not include passwords, authentication tokens, or more business data than is necessary to explain the concern.