Security
Your customers’ files are their intellectual property
A buyer uploading a part to your website is handing over a design they may have spent months on. That is the most sensitive thing on this platform, and most of what follows is about it.
Private by default, and yours to delete
Private storage, signed short-lived links
Files are never publicly addressable. Access is through links that are signed and expire, issued only to people entitled to them.
Encrypted in transit and at rest
TLS 1.2 or better at the edge, with HSTS. Database and object storage encrypted with provider-managed keys. New secrets, such as a shop’s own mail-server password and provider keys, get an additional layer of application-level encryption with rotation; webhook signing keys and two-factor seeds are moving to it one at a time. API keys are stored as hashes and never recoverable.
Retention you choose
You set how long uploaded files are kept, and retention is enforced by a scheduled job rather than by good intentions. Deleting means deleting.
We do not use your files for anything else
Not for training, not for benchmarks, not for examples. The draft terms say the same: your data is used only to provide the service.
Download audit log
Who fetched which file and when. If a customer ever asks, you can answer.
Hostile files are treated as hostile
Format is determined by sniffing the bytes, never by trusting an extension. Parsing happens in a separate, supervised process with a time limit, size limits, zip-bomb guards and XML entity expansion disabled.
One shop cannot see another
Every handler declares the permission it requires and the tenancy is enforced again in the database itself with row-level security, so a bug in an application query is not enough to cross a tenant boundary. Each deployable connects with its own restricted database role: the service that answers buyers cannot read your team, your API keys or the audit log, and can only read the configurations the console writes.
Cross-tenant reads and writes are asserted to fail for every tenant table by a test that picks up each new table, so a new table cannot quietly skip the check. The one exception still being closed is the audit log, which is isolated by its query rather than by a policy.
Getting in, and staying out
Password hashing
argon2id with the memory-hard parameters OWASP recommends.
Breached-password check
Not built yet. A check against a k-anonymity API, which would only ever see a prefix of your password’s hash, is planned.
Two-factor
TOTP from any authenticator app, with single-use recovery codes; WebAuthn is not built yet. Your active sessions are listed in Settings, and changing your password signs out the others.
Throttling and anomaly notice
Login attempts are limited, and a sign-in from a browser we have not seen before is e-mailed to you.
SSO
Sign in with Google or another OpenID Connect provider the platform has switched on. SAML, and a shop’s own identity provider for its team, are not built yet.
Roles and audit
Team members have roles, and actions that matter are written to an audit log you can read.
It cannot be used against you
- A widget key answers only the origins you list. A stolen key does not work from somebody else’s site.
- Test keys and live keys are different keys, so staging cannot spend your quota or create real orders.
- The widget sets no cookie, which is why it needs no consent banner.
- It runs inside a shadow root and never throws into your page.
- You choose the widget version in the console, the latest or one pinned. Subresource Integrity for pinned versions is not built yet.
- Rate limits apply per key, per IP, per tenant and per session, and the same file in the same session counts once against your quota.
What we are, legally, and what we collect
For your buyers’ data we are a processor and you are the controller; for your own account data we are the controller. A data processing agreement is drafted and waiting for review by counsel, and the sub-processor list is not published yet. The tooling to export or delete everything associated with a buyer’s e-mail address within your tenant is built.
Analytics are minimised by design: the usage events behind your charts record no IP address. EU data region at launch; backups come with restore drills that check what came back.
How the software is kept honest
- Dependency auditing and licence policy enforced in CI, with pinned base images and image scanning.
- An SBOM per release and signed images.
- A threat model maintained per flow, in the repository, alongside the code it describes.
- An incident-response runbook.
- No unsafe code in the engine, no
unwrapin library code, and no floating-point money anywhere.
What we do not claim
- No SOC 2 report. Type I then Type II is on the roadmap. We will publish the date when we have one, not before.
- No ISO 27001 certificate. Also roadmap.
- No completed external penetration test yet. One is required before general availability, and we will say who did it.
- No ITAR or CMMC handling. That needs a dedicated or on-premise deployment and we do not offer one yet. If your work is controlled, please do not put it through the hosted service.
- US data region is not live. EU only at launch.
Found something?
Report it through the contact page and we will respond. A disclosure policy at /.well-known/security.txt is not published yet.