# Security overview

> How ShopAssist protects your store, your team and your shoppers, with links to the details.

Source: https://shopassist.coec.dk/docs/security/overview · Updated 2026-10-01

ShopAssist is built so that a mistake in one layer does not expose your data: every request is authenticated and authorized, every store's data is isolated in the database, and the AI can only state prices and stock that come from your store.

| Area       | What we do                                                                         | Details                                                                                            |
| ---------- | ---------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- |
| Hosting    | EU only, in Germany                                                                | [Hosting and architecture](/docs/security/hosting-and-architecture)                                |
| Encryption | TLS in transit, encrypted disks and application-level encryption of credentials    | [Encryption](/docs/security/encryption)                                                            |
| Isolation  | every query is scoped to the store; row-level security in the database enforces it | [Hosting and architecture](/docs/security/hosting-and-architecture#isolation)                      |
| Access     | roles, store restrictions, MFA, sign-in again for sensitive actions                | [Roles and permissions](/docs/team/roles-and-permissions)                                          |
| Support    | read-only, redacted, time-limited and only when you allow it                       | [Support access](/docs/team/support-access)                                                        |
| AI safety  | grounded prices and stock, confirmation for actions, prompt-injection defences     | [Prompt injection and safety](/docs/security/prompt-injection-and-safety)                          |
| Widget     | origin allowlist, rate limits, bot protection, strict CSP support                  | [Bot protection](/docs/widget/bot-protection), [CSP](/docs/widget/content-security-policy)         |
| Outbound   | signed webhooks, static egress addresses, SSRF-safe fetching                       | [Egress IPs](/docs/security/egress-ips), [webhook signatures](/docs/webhooks/verifying-signatures) |

## Your part [#your-part]

* Turn on two-factor authentication for every member (**Settings → Security**).
* Give members the lowest role they need, and restrict agencies to their stores.
* Keep API keys and the identity secret on your server; rotate them when people leave.
* Keep the plugin for your platform up to date.

## Report a problem [#report]

Report vulnerabilities to [security@coec.dk](mailto:security@coec.dk). See [responsible disclosure](/docs/security/responsible-disclosure).