Security

Security isn’t a feature we bolted on — it’s the first rule of how the platform is built. Every store’s data is isolated from every other store at the database level, payment details never touch our servers, and the isolation between tenants is enforced by code and checked automatically on every change. This page describes the protections that are in place today and the ones we’re still building.

Built on certified infrastructure

We run on established providers that maintain independent, third-party security certifications. These certifications belong to the providers and cover the infrastructure we build on:

• Vercel (application hosting and content delivery) — SOC 2 Type II and ISO 27001 certified.
• Supabase (database, authentication, and file storage) — SOC 2 Type II and ISO 27001 certified.
• Stripe (payment processing) — PCI DSS Level 1 (the most stringent level in the payments industry) and SOC 2 Type II.

How we protect your data

• Store isolation: every store’s data is separated using database row-level security, so one store can never read or change another’s. Public storefront pages read through restricted, purpose-built interfaces rather than direct database access. This boundary is covered by an automated test suite that runs on every change.
• Payments: card details are entered directly into Stripe and go straight to Stripe — they never reach our servers. We store only payment references (amounts and identifiers).
• Encryption: all traffic is served over TLS, and data is encrypted at rest by our managed database provider.
• Authentication: passwords are hashed by our authentication provider, sessions are verified on the server, and sensitive actions are rate-limited to slow down abuse.
• Accountability: consequential changes inside a store are recorded to a tamper-resistant, append-only activity log that store members can review.
• Your data rights: merchants can export their full store data and permanently delete their store; shoppers with a store account can export and delete their data. (See our Privacy Policy.)
• Privacy-first analytics: storefront traffic is measured with cookie-less, aggregate counters — no advertising trackers and no cross-site profiling.
• Secure development: every change is type-checked, linted, built, and tested automatically before it ships, and dependencies are version-pinned.

Working toward SOC 2 and ISO 27001

To be clear about where we stand: the platform is built with controls aligned to SOC 2 and ISO 27001, and it runs on infrastructure that is already certified to those standards — but the platform itself is not yet SOC 2 or ISO 27001 certified. Those certifications are on our security roadmap. We’d rather tell you exactly where we are than imply a badge we haven’t yet earned.

Areas we’re actively investing in include:

• Multi-factor authentication for merchant accounts.
• Expanded security monitoring and alerting.
• Formal security policies, and an independent third-party audit.

Reporting a vulnerability

If you believe you’ve found a security issue, we want to hear from you. Please report it privately rather than posting it publicly, and give us a reasonable window to fix it before any disclosure. We commit to acknowledging good-faith reports and will not pursue researchers who act responsibly and avoid harming other users’ data. Use the security contact published on this platform to reach us.

A note on shared responsibility

No system is perfectly secure. We protect the platform and the isolation between stores; merchants remain responsible for their own account credentials, the content they publish, and their own customers’ data. Store owners: use a strong, unique password and keep your recovery email secure.

Contact

Questions? Contact the platform operator via the address published on this platform’s website.