Security
Security overview
How ShopAssist protects your store, your team and your shoppers, with links to the details.
ShopAssist is built so that a mistake in one layer does not expose your data: every request is authenticated and authorized, every store's data is isolated in the database, and the AI can only state prices and stock that come from your store.
| Area | What we do | Details |
|---|---|---|
| Hosting | EU only, in Germany | Hosting and architecture |
| Encryption | TLS in transit, encrypted disks and application-level encryption of credentials | Encryption |
| Isolation | every query is scoped to the store; row-level security in the database enforces it | Hosting and architecture |
| Access | roles, store restrictions, MFA, sign-in again for sensitive actions | Roles and permissions |
| Support | read-only, redacted, time-limited and only when you allow it | Support access |
| AI safety | grounded prices and stock, confirmation for actions, prompt-injection defences | Prompt injection and safety |
| Widget | origin allowlist, rate limits, bot protection, strict CSP support | Bot protection, CSP |
| Outbound | signed webhooks, static egress addresses, SSRF-safe fetching | Egress IPs, webhook signatures |
Your part
- Turn on two-factor authentication for every member (Settings → Security).
- Give members the lowest role they need, and restrict agencies to their stores.
- Keep API keys and the identity secret on your server; rotate them when people leave.
- Keep the plugin for your platform up to date.
Report a problem
Report vulnerabilities to security@coec.dk. See responsible disclosure.
Last updated on