Security Overview

2. Authentication

Sign-in uses a cryptographically verified session token, checked against the identity provider's public keys on every request.

GetShopSync stores no passwords. There is no password of any user in our database, so there is nothing of that kind for an attacker to take.

Every authenticated route requires a verified session by default, rather than each route opting in.

3. Authorisation and separation between customers

Access is checked on the object, not only on the menu. Fetching a record and then testing whether the caller may see it is the order that closes the common class of flaw where changing an identifier in a URL exposes someone else's data.

Five role levels are assigned per catalogue: shop user, shop manager, account user, account owner and super admin. Access is granted by explicit assignment, never by default.

Account-level users can reach every catalogue in their own account and nothing beyond it.

4. Application controls

• HTTPS in production.
• Server-side validation, with protection against unexpected fields being written on update.
• Protection against requests to internal or private network addresses when fetching a supplier page, including through redirects.
• Uploaded files validated by inspecting their contents, not by trusting the file name or extension.
• Sanitisation of rich text before it is rendered.
• Datasheet links signed cryptographically.

5. Data and infrastructure

• Application data in a managed database service.
• Files and datasheets in object storage under your account, copied there rather than hotlinked from a supplier.
• Secrets held in environment configuration.
• Where you supply commerce credentials, use least-privilege keys and rotate them when staff change.

6. AI processing

Capture sends the retrieved page content to a third-party model provider. Do not put unnecessary personal information into capture features.

AI model usage is billed by the AI provider to the API key you configure. GetShopSync does not resell AI tokens. Product capacity on your plan is the commercial limit; additional product packs can be purchased when you need more SKUs.

7. What we expect of you

• Protect user accounts and use strong authentication.
• Review captured content before publishing it.
• Only target web addresses you are entitled to access.
• Keep your own backups of catalogue data your policies require you to hold.
• Report a suspected incident to security@getshopsync.com promptly.

8. Incidents

We investigate security incidents affecting the service and notify affected customers and, where personal information is compromised, the Information Regulator, as POPIA requires.

9. What we are still improving

Stated plainly, because a security page that lists only strengths is not useful to the person evaluating it:

• Automated test coverage in the deployment pipeline is limited and is being expanded.
• Structured logging with request and tenant correlation is being introduced.
• A full data-residency map across every provider is being completed.
• Single sign-on through SAML is not yet available.
• We hold no ISO 27001 certification and none is in progress. We will not claim one.

10. Security questionnaires

We complete security questionnaires and data processing agreements for qualified opportunities. Write to security@getshopsync.com.

11. Status of this page

This overview describes how the service is built and operated. It is not a certification, an audit report or a warranty. The binding commitments are those in the Terms of Service and any written agreement between us.