Security by default
Modern sign-in
Email and password, magic links, Google, Apple, Microsoft and Lovable accounts.
Two-factor authentication
Authenticator-app codes (TOTP) protect every account that handles money.
Leaked password check
Passwords are checked against known breach databases.
Escrow
Buyer funds are held until the domain transfer is confirmed.
Row-level access
Every offer, order and listing is visible only to the people involved.
Separated roles
Buyer, seller, broker and admin permissions are stored and enforced server-side.