Encryption

In transitCopy Anchor Link

Every endpoint uses TLS 1.2 or newer with HSTS. Calls to your store, AI providers, helpdesks and webhook endpoints use HTTPS with certificate validation and never follow redirects to non-HTTPS URLs.

At restCopy Anchor Link

Servers and backups use disk encryption. On top of that, secrets are encrypted in the application before they reach the database:

• store connection credentials and plugin secrets;
• your AI provider keys (BYOK);
• helpdesk tokens, Slack webhook URLs and webhook signing secrets;
• two-factor authentication secrets.

Each value gets its own random 256-bit key (AES-256-GCM), which is itself encrypted with a master key that only the services that need it hold. Every encrypted value is bound to its table, row and tenant, so a value copied to another row or store cannot be decrypted. Master keys are rotated at least every 12 months.

Secrets shown onceCopy Anchor Link

API keys, webhook secrets, identity secrets and status-webhook URLs are shown once when created. ShopAssist stores only a hash of API keys and never returns stored credentials, not even to owners. To change one, rotate it.

PasswordsCopy Anchor Link

Passwords are hashed with Argon2id. New passwords are checked against known breached passwords. Accounts lock for 15 minutes after repeated failed sign-ins.