Security

The integration secrets you entrust to us — Shopify tokens, WooCommerce keys, InPost tokens, API keys for mailing providers (MailerLite, Mailchimp, Brevo) and form-webhook signing secrets — are encrypted at rest with AES-256-GCM, with the master key derived via scrypt.

IP addresses recorded with store form submissions are hashed with SHA-256, so we can detect abuse without storing raw addresses.

All traffic is encrypted with TLS. Store builds run in an isolated pool of child processes, so one build cannot interfere with another or with the platform.

We run on servers located in the European Union (Hetzner, Germany). We maintain database backups so data can be recovered after an incident.

Who we share data with and how we process it is covered on the Subprocessors page and in our Data Processing Agreement.