Security built into the core.
Retail Commerce OS handles your customers' PII, payment references and business data. Here is exactly how we protect it.
All data between your browser and our API travels over TLS 1.2+. Caddy handles certificate provisioning automatically via Let's Encrypt — no manual rotation.
Granular per-workspace RBAC: every API mutation checks the caller's role and permission before executing. Permissions are catalogued and auditable.
Key create, update and delete actions across core modules are recorded with actor, timestamp and IP. Append-only by design — nothing in the product edits or deletes a written record.
All DB queries are scoped to the requesting workspace's ID. A workspace cannot read or write another tenant's data — isolation is enforced at the query layer, not just the route layer.
Shopify, Razorpay and telephony API keys are encrypted at rest using AES-256-GCM before being stored. The raw key never appears in logs or DB snapshots.
Sessions are stored as HttpOnly, Secure, SameSite=Lax cookies scoped to the retailcommerceos.com domain. Cross-subdomain sessions use a COOKIE_DOMAIN binding, not third-party cookies.
We publish a Data Processing Addendum (DPA) covering DPDP Act 2023 (India) and GDPR requirements. Customers can request data export or deletion at any time.
Our sub-processor list is published in section 4 of the DPA (Shopify, Razorpay, Brevo, Cloudflare, AWS S3, Anthropic, Twilio, Deepgram and our logging provider) and we notify customers 30 days before adding new processors.
Security practices at a glance
These apply to the Retail Commerce OS platform — not add-on options.
- TLS everywhere
All endpoints — REST, WebSocket and static assets — served over HTTPS.
- Log redaction
Structured logs redact customer email, phone and payload fields before they leave the process — including on our GDPR erasure path.
- Rate limiting
Per-IP and per-workspace rate limits on all API endpoints prevent abuse.
- Webhook verification
All inbound webhooks (Shopify, Razorpay, Meta, Twilio) are HMAC-verified before any DB write.
- Dependency freshness
24-hour supply-chain guard enforced at install time via bunfig.toml minimumReleaseAge.
- Secret scanning
No secrets committed to source control — all production keys live in server-side .env.
Responsible disclosure
If you discover a potential security issue, please email [email protected] rather than opening a public issue. We respond within 48 hours and aim to patch confirmed vulnerabilities within 7 days.
For data-related requests (access, export or deletion) under DPDP or GDPR, contact [email protected].