ShipStation needs dedicated user permissions for Suppliers and Purchase Orders.
Currently, non-administrator users may still be able to view sensitive supplier information, including:
- Supplier names
- Contact names
- Email addresses
- Phone numbers
- Physical addresses
There does not appear to be a way to separately restrict access to the Suppliers page or prevent operational users from viewing Purchase Orders.
Please add granular permissions that allow administrators to independently control whether a user can:
- View supplier information
- Add, edit, or delete suppliers
- View Purchase Orders
- Create or edit Purchase Orders
- Submit or cancel Purchase Orders
- Receive inventory against Purchase Orders
These permissions should be separate from existing permissions for Order Management, Shipping, Product Management, and general Inventory Management.
For example, warehouse employees may need access to customer orders, inventory quantities, and shipping labels without needing access to confidential supplier, pricing, or purchasing information.
Access to supplier and purchasing information should follow the principle of least privilege rather than being available to every operational user by default.