Security

Komissio runs on servers from our hosting provider DigitalOcean. Traffic passes through Cloudflare, which provides HTTPS and helps protect the service against attacks such as DDoS. Payments run through Stripe, so card numbers never touch our servers.

• All traffic to komissio.io and our API is encrypted with HTTPS (TLS).
• Passwords are hashed with bcrypt and never stored in plain text.
• API keys are stored only as SHA-256 hashes, so we cannot read them back. You see a key once, when you create it.
• Webhooks from Stripe and Shopify are checked by signature before we process them.
• Each merchant's data is kept separate in the application, and every request is checked against the account that owns the data.

• Merchant team members have role-based permissions, so each person sees only what their role allows.
• Internal admin access is limited to the people who need it, and two-factor authentication is available for admin accounts.
• Sensitive admin actions are written to an audit log.
• Sessions use short-lived access tokens and refresh tokens that can be revoked.

• Input to our API is validated before it is processed.
• Login and other sensitive endpoints are rate limited.
• We keep dependencies up to date and check them for known vulnerabilities.

We back up our databases regularly so that we can restore data after a failure. We monitor the service and work to fix incidents as quickly as possible. Where we can, we announce planned maintenance in advance.

If a security incident affects personal data, we notify the affected customers without undue delay, and within 72 hours where our Data Processing Agreement requires it. We also notify the authorities where the law requires it.

If you find a security issue, please email [email protected] with "Security" in the subject line. Please give us reasonable time to fix it before you share it publicly, and do not access or change data that is not yours. We will reply and keep you updated.