What actually protects your account, your API keys and the events flowing in and out. We hold no third-party certifications and say so on this page.
In the product today
Account security — passwords hashed with bcrypt, server-side sessions you can list and revoke, lockout after repeated failed logins, and an alert when a new device signs in.
Two-factor and passkeys — optional TOTP per user, WhatsApp or email OTP verification, and WebAuthn passkeys.
API security — per-account keys you create and revoke, with rate limiting on API, login and OTP endpoints.
Webhook integrity — outbound events are HMAC-SHA256 signed; inbound payment, WooCommerce, Shopify and plugin webhooks are verified on the raw body.
Platform hardening — security headers and a CORS allowlist, an SSRF guard on customer-supplied URLs, and encrypted storage of integration secrets when the encryption key is configured.
Monitoring and backups — errors reported with auth headers stripped, and nightly database backups with a tested restore script when the cron is installed.
What we do not claim
No SOC 2, ISO 27001 or HIPAA certification.
No uptime SLA figure until there is a measurement behind it.