Encryption in transit
Platform traffic travels over HTTPS; session cookies are set on secure connections and readable only by the server (httpOnly).
Security
Your data is safe
The technical and organisational measures we apply to protect your stores' and customers' data.
Password security
Passwords are never stored in plain text; they are hashed one-way with scrypt. A password of at least 8 characters with an uppercase letter and a digit is required.
Short-lived sessions
Access tokens are short-lived and rotated with a separate refresh token; unless “Remember me” is chosen, the session ends when the browser closes.
Company-scoped access
Every user sees only their own company's data. Users are invited by the company and can be deactivated at any time.
Reporting a vulnerability
If you believe you have found a security vulnerability, please send the details to [email protected]. We keep reports confidential, verify them and keep you informed about the fix. Please do not attempt to access other users' data or disrupt the service.
For information on how personal data is processed, see the KVKK Privacy Notice.