Security and compliance
Built for a category the big platforms refuse.
Hemp and kava businesses operate inside a compliance gap. Mainstream processors freeze accounts on suspicion. Mainstream messaging platforms ban cannabis SMS outright, by policy. Mainstream agencies wire up payment flows that miscode products and build automations that touch data they should never see. Throughput was built because all of those failures were predictable, documented, and avoidable. Here is how we stay on the right side of every one of them.
The payment bright line
A Visa or Mastercard charge may only carry SKUs flagged as federally legal hemp. Plant-touching THC is routed to bank rails (Aeropay), never to a general card processor. We never miscode marijuana as hemp. We never build cashless-ATM flows.
Card data routes from the customer straight to the processor and never passes through our servers. You never store card numbers. You never handle chargebacks through us. The processor is responsible for PCI compliance because they are the only party that ever sees the card.
You own everything
Your software runs on your own accounts: your Supabase project, your domain, your card processor relationship. Throughput configures and maintains it. You own it.
If you ever leave, you keep everything. Your database, your customer records, your transaction history, your code. There is no hostage data, no export-to-CSV moment, no vendor that disappears and takes your records with them.
Isolation (Level C)
Every client gets their own folder and their own copy of the code. When hosted, every client gets a sealed container. A change made for one business cannot affect another business. A breach at one client cannot reach another client.
There are no shared tables, no shared org IDs, no multi-tenant data models where a query bug exposes someone else. One Supabase project per client. One domain per client. One code copy per client. Isolation is structural, not a configuration setting.
HIPAA stance
For doctors, therapists, and psychiatrists we build only things that never touch patient data. The system works with anonymized IDs. The compliant vendor stays the data vault. We never take custody of a patient record or a health identifier.
If a task requires handling protected health information, we do not build it and we say so up front. This is not a limitation. It is the only way to build something in this space and stay on the right side of the regulation.
Why this matters: the receipts
These are not hypothetical risks. They are documented incidents and published policies from the platforms your competitors use.
PayPal froze $9,000 belonging to CBD retailer Friends NYC and permanently locked the account for alleged "sale of narcotics" despite hemp-derived CBD being legal under the 2018 Farm Bill. The merchant sued for over $100,000 in damages, fees, and interest.
Source: Law Street Media (2021)
Birdeye's own help center confirms cannabis and CBD businesses cannot send SMS through its platform. Carriers have banned cannabis-related keywords, and text messages from cannabis businesses are not permissible in the US. Birdeye routes these clients to email-only webchat instead.
Source: Birdeye Help Center (2025)
See what compliance-first looks like in practice.