Security, data and going live · Cultivar, medicinal cannabis ordering software

Hosting and data

Where it runs: Cultivar’s platform is powered by BeetSales. Hosting region, retention periods and the data-processing terms for your organisation are confirmed in writing before you go live.
What is confirmed in writing: Region, retention, processing terms, and the questions your privacy officer brings to the demo. We answer those in writing as part of going live, not after.

A verified login, or nothing: No product, price or supplier is visible without a verified login. There are no public product pages, by design, and it is not configurable.
Each organisation sees its own records: A distributor sees its pharmacies’ orders, never their patients. A grower sees demand by distributor, never a dispensary’s customers. A field that is not yours is never sent to your desk. The platform enforces the separation; it does not rest on a setting anyone could change.

Audit trail: Every change to an order, an allocation or a batch record is stamped with who made it and when. Nothing is deleted in place.
Ownership and export: Each organisation owns its own records. Your ledger, your orders and your reports can be exported at any time as plain files, so an inspection or a migration never depends on us being in the room.
Schedule 8: Every unit received, supplied and on hand is recorded per batch, per organisation and per transaction as the order goes through, so the balance an inspector asks for is a query you can run in front of them. We do not replace a register your state’s regulation requires in a specific form; we give you the export to fill it.

What we record: A pharmacy records its approval number, its pharmacist in charge and its state licence when it joins; a supplier records its licence and permit details. Cultivar checks those for expiry on every order and blocks supply against an expired one.
What we do not claim: We record what each organisation states. Independently confirming it with the regulator remains the licence holder’s responsibility, and we say so on every page where those details appear.

01
The demo, on your data
A working session with one of your batches, your pharmacy accounts and the report you filed last period. We show what Cultivar would have recorded, on real screens, and we answer the compliance questions in the room.
02
Scope and terms
How much history comes across and how many pharmacy accounts there are decide the effort, and we size it in front of you rather than print a number. Hosting, retention and processing terms are confirmed in writing at this point.
03
Your history loaded
Opening balances, batches, pharmacy accounts and current Schedule 8 positions are loaded before you take a single order in the platform. You retype nothing.
04
Your pharmacies brought across
They order in a browser, with no installation and no training day. A pharmacy that prefers to email still can, and that order is keyed into the same record.
05
The first report from Cultivar
Your first six-monthly report covers the whole period, including the months before you switched, and is exported for your review and sign-off.

It is not legal advice: Nothing on this site is legal advice. Your obligations under your licence and your state’s poisons regulation remain yours, and we are careful to say what Cultivar records rather than what it certifies.
It does not list attestations we have not published: Where a buyer needs a hosting, security or privacy attestation, bring the requirement to the demo. We answer in writing as part of going live, and we would rather say so here than imply one.