Primary platform in Germany.
The app and primary Postgres data platform run with STRATO in Germany. Payment and email services are separate external processing paths listed below.
Your data. Protection you can verify.
App and database run on servers in Germany (STRATO). External service providers are listed in the privacy policy. This page does not claim a certification or blanket EU-only processing.
Our security principles
Transport and secrets protected.
Security headers and HTTPS are configured in the product. Connection tokens are encrypted at the application layer and are not delivered to the browser.
Access by tenant and role.
Protected routes check organization, shop assignment, and role. Administrator and accountant access use separate permission boundaries.
Recovery procedures prepared.
Database and deployment backup, restore, and rollback procedures exist. Specific RPO, RTO, or geographic redundancy commitments are only made contractually after operational verification.
Incidents are assessed.
Security events are assessed against affected data, systems, and notification duties. Communication follows legal and contractual requirements rather than a blanket marketing deadline.
Data rights with review.
Export and deletion requests are authenticated before processing. Tax and commercial retention obligations are considered before final deletion.
Technical controls
Evidence over claims.
Primary platform
STRATO in Germany
External providers are listed in the subprocessor section
Data access
Tenant- and role-aware access checks
Server routes verify organization and permissions
Transport
HTTPS, HSTS, and security headers are configured
Current TLS configuration is verified during deployment
Authentication
NorthProfit Auth with email verification and password reset
OAuth connections complete on the server
Sessions
HttpOnly, Secure, and SameSite cookies
Sensitive reset tokens are removed from browser URLs
Connection credentials
Application-encrypted tokens and credentials
Key material remains server-side
Audit
Supported critical organization actions are logged
No blanket retention period is promised
Backups
Backup and restore procedures are documented
Current operational state is checked before releases
Monitoring
Server errors and operational state are captured internally
No public availability SLA is promised
Data rights
Export and deletion requests have dedicated workflows
Legal retention duties may continue to apply
Providers and processing paths
This list describes operational paths documented in the code. Contract status, data region, and transfer mechanism must be checked for the specific agreement against current provider and privacy documentation.
| Provider | Purpose | Classification | Info |
|---|---|---|---|
| STRATO (NorthProfit data platform) | App hosting, primary data storage, and authentication data | Germany · primary platform | Provider information |
| Stripe | NorthProfit billing for non-Shopify customers; Shopify merchants are billed through Shopify Billing | Check current provider and contract information | Provider information |
| Resend | Outbound transactional email, including verification, password reset, and invoice delivery | Check current provider and contract information | Provider information |
Available connections
Stores and marketplaces
The integrations page shows which store and marketplace connections can currently be started. Providers that are not yet available are clearly marked as coming soon.
| Integration | Availability | Note |
|---|---|---|
| Shopify | App Store release pending | The Shopify app is not yet published in the Shopify App Store; the release is pending. Existing installations keep working. |
| WooCommerce | Setup available | The connection is set up with your store; data scope depends on version and permissions. |
| Shopware 6 | Setup available | The connection is set up with your store; data scope depends on version and permissions. |
| Amazon Seller | Coming soon | Amazon Seller is not available yet. |
| TikTok Shop | Setup available | TikTok Shop is available for shops in Germany; connection with TikTok sign-in. |
| eBay | Setup available | The connection is set up with your seller account; data scope depends on marketplace and permissions. |
Security controls
This separates technical controls that are in place from points that must be reviewed for each contract or customer setup.
Tenant separation and role-based access
Implemented in protected server routes and data access
Security controlsIn placeEmail verification, password reset, and session protection
Dedicated auth flows with rate limits and origin checks
Security controlsIn placeCustomer-specific DPA scope
Review against the concrete setup before contract signature
Security controlsReview per setupIndependent certification or penetration-test attestation
Not represented as completed on this page
Security controlsReview per setup
Security questions?
Your CISO can write to us directly.
Security questions and existing contract or architecture documents can be requested individually. We only provide documents that exist and are approved for sharing.
Responsible disclosure is welcome. Triage and priority depend on severity and reproducibility.