Security isn't a feature we added once the product worked — it shapes how the platform is built. This page lays out the controls running in production today, where we stand on compliance, and how we respond when something goes wrong. If you need more detail than what's here, our security team is one message away.
1. Encryption
Data moving between your browser, our edge, and our servers is encrypted in transit with TLS 1.2 or higher. We don't accept connections over older, weaker protocols.
Data at rest is encrypted with AES-256. Encryption keys are managed in AWS Key Management Service, backed by hardware security modules, so the keys that protect your data are themselves protected in dedicated hardware.
2. Access controls
Access to production is restricted to the people who need it, protected by multi-factor authentication and least-privilege roles. Production sessions are logged and auditable.
The platform separates identities into distinct pools — shoppers on the storefront, merchant operators in the store admin, and Vendor platform administrators — each backed by its own identity store. A compromise in one cannot be used to escalate into another.
3. Audit logging
Sensitive and state-changing actions are recorded automatically — who did it, what they did, what was affected, when, and from which IP and device. The log is append-only and retained in line with our Data Processing Agreement.
Operators can export their tenant's audit trail from the admin or via the API, which is useful when assembling evidence for SOC 2 or ISO 27001 reviews.
4. Sub-processors
We rely on a small, deliberately limited set of third parties to run the platform. The full list — what each one processes and which region it operates from — is published at /security/sub-processors and kept current whenever it changes.
Before a new sub-processor begins processing customer data, we notify customers by email with at least a 30-day window to raise an objection.
5. Compliance status
Here's where we stand on the frameworks our customers ask about most:
Available to customers and prospects under NDA: our Data Processing Agreement on request, and our SOC 2 Type II report once the audit is complete.
- GDPR — aligned; Data Processing Agreement available on request.
- SOC 2 Type II — in progress, targeting Q4 2026.
- ISO 27001 — planned for 2027.
- PCI DSS — card data is handled entirely by external PCI-DSS-compliant payment providers (Stripe, PayPal, and regional bank gateways) through hosted and redirect flows. Vendor does not store cardholder data, which keeps our PCI scope to the minimum (SAQ A).
6. Vulnerability management
We keep our software dependencies current and track newly disclosed vulnerabilities, prioritising patches by severity so the most serious issues are addressed first.
Independent security researchers can report issues to us directly through our coordinated vulnerability disclosure program at /security/disclosure, which includes safe-harbor protections for good-faith research.
7. Incident response
When something goes wrong, we'd rather over-communicate than leave you guessing. Service-impacting incidents are posted to /status as we work them, and affected customers are notified directly in line with our SLA and Data Processing Agreement — including within 72 hours for any breach involving personal data, as required under GDPR.