OAuth, not passwords
Merchants grant scoped access and can revoke it.
SECURITY + TRUST
Real controls. No borrowed certification badges.
This page describes current product controls. We do not claim SOC 2 or ISO certification before earning it.
Tenant isolation
Operational queries are scoped to the merchant identity.
Secret encryption
Sensitive access tokens are stored encrypted.
Reliable webhooks
Signature verification, deduplication and controlled replay.
Access control
Separate merchant and internal operations sessions.
Consent and preferences
Engagement respects consent and quiet hours.
Deletion and export
Operational paths support data requests.
Fault monitoring
Logs, metrics and alerts avoid sensitive data leakage.
Commerce Growth OS