Security

How we protect your data and keep the platform secure.

Infrastructure

  • ✓ Hosted on DigitalOcean — Frankfurt, Germany (EU). No data leaves the EU except where explicitly stated (see GDPR).
  • ✓ All services run inside isolated Docker containers with least-privilege access.
  • ✓ Production database: DigitalOcean Managed PostgreSQL — automated backups, point-in-time recovery, TLS-only connections.
  • ✓ Queue and cache: DigitalOcean Managed Redis — TLS-only, private network access only.
  • ✓ File storage: DigitalOcean Spaces (S3-compatible) — private buckets; imports and exports are reachable only through an authenticated request.
  • ✓ Product images are served publicly, by design: a storefront carries no login and its images have to load for shoppers. They are the only thing served this way, and nothing else in the bucket is reachable through that route.
  • ✓ DDoS protection and CDN via Cloudflare.

Data encryption

  • ✓ All data in transit encrypted with TLS 1.2+.
  • ✓ Passwords hashed with bcrypt (cost factor 12) — never stored in plain text.
  • ✓ API keys and storefront keys are stored as SHA-256 hashes, never as the key itself. We cannot recover your key, and neither can anyone who reads our database — which is why a key is shown only once, at creation.
  • ✓ Database connections require SSL (sslmode=require) in production.

Authentication & access control

  • ✓ Session tokens are short-lived JWT signed with HS256.
  • ✓ API key authentication for programmatic access — keys are shown only once at creation.
  • ✓ Every business table carries a tenant_id, and every query is scoped to the tenant resolved from the request. Database-level row policies are being added as a second layer beneath that.
  • ✓ Production server access limited to authorized personnel via SSH key authentication only — password login disabled.
  • ✓ No shared credentials. Each service has its own credentials with minimum required permissions.

Application security

  • ✓ All user input validated and sanitized before processing.
  • ✓ File uploads streamed — files are never fully loaded into memory, limiting memory exhaustion attacks.
  • ✓ CORS policy restricts API access to known origins (web app and Chrome extension IDs).
  • ✓ Authentication endpoints are rate limited.
  • ✓ Dependencies are pinned and reviewed when updated.
  • ✓ Chrome extension uses Manifest V3 with strict Content Security Policy — no remote code execution.

Monitoring & incident response

  • ✓ Uptime and service health monitored 24/7 via BetterStack. Status available at status page.
  • ✓ Structured logs carry a request ID and a tenant ID, so a single request can be traced end to end. Logs do not contain credentials.
  • ✓ In the event of a data breach, affected users are notified within 72 hours as required by GDPR Article 33.

Responsible disclosure

If you discover a security vulnerability in CommerceBase, please report it responsibly. Do not publicly disclose the issue until we have had a chance to investigate and address it.

Send your report to security@commercebase.io with a description of the issue, steps to reproduce, and potential impact. We aim to acknowledge reports within 48 hours and resolve critical issues within 7 days.

Report a vulnerability →