Security
Your books, kept safe and kept yours.
StoreDeck holds your sales, your costs and other people's money. Here is how it is protected, in plain words.
- An encrypted connection HTTPS on every request, and browsers told to use nothing else
- Your sign-in A password, two-step verification if you turn it on, and a session that ends on its own
- The database's own rules Your role, checked for this store, on every read and every write
- Your records Only the records your role may see, and every change kept
In practice
What protects your books
Access the database enforces
Every read and every write is checked by the database against your role on that store, so someone who cannot see a page cannot fetch its records either.
Encrypted on the way and where it is kept
Every connection is HTTPS, with browsers told to refuse anything else, and your books, your files and their backup copies are encrypted with AES-256 where they are kept.
Secret keys never reach a browser
The keys that can pass the database's rules are never sent to a browser, and every build is checked for them before it can go live.
Card details stay with Stripe
You pay for StoreDeck on Stripe's own pages. Stripe is certified to PCI Service Provider Level 1, and we never see or store a card number.
Only the last four digits
For the cards and bank accounts your books record, we keep the scheme, the bank and the last four digits, never the number.
Passwords never kept
Sign-in is run by Supabase, which keeps a salted one-way hash of each password and never the password itself.
Two-step verification
A code from an authenticator app after your password, on every plan. An account's owner can require it of everyone on the account.
Google, on your own address
Continue with Google signs in only the Google account on the address you sign in with: at once where Google holds that inbox (Gmail, Google Workspace), and for any other address only once you connect it, signed in with your password. Your two-step code is still asked for. It makes a new account only where Google holds the inbox; any other is made with the sign-up form, its address proved by the link we email.
New sign-ins emailed
Signing in from a browser your account has not used before sends you an email, as adding or removing a passkey does, and Settings can sign out every other device.
Sessions that end
A sign-in ends after a set time however busy you are, with a warning five minutes before, so a browser left open does not stay signed in.
Strict browser rules
The app loads code only from its own address and connects only to StoreDeck and its database, with no third-party trackers and no advertising. A listing synced from eBay shows its photos from eBay's own picture servers.
Accounts that are checked
A new account opens only once its email address is confirmed, disposable inboxes are refused, and repeated sign-ups and password resets are limited.
Every change recorded
Each change to a record keeps who made it, when, and what it was before and after. A deleted record can be brought back for 30 days, and a closed account is archived rather than erased.
Your data
Kept in the EU, handled by a few
Your books and their files are kept by Supabase in Frankfurt, Germany. A small set of processors handle them for us, each bound by their own data-processing terms. We do not sell data, and we share it with no one else unless the law requires it.
Read the Privacy Policy- SupabaseThe database, sign-in, file storage and live updates
- NetlifyHosting the app and these pages
- StripeSubscription payments, invoices and tax
- ResendEmail: confirmations, invitations, password resets and notices
- CloudflareThe daily backup copies, kept in the EU
Backups
Copied every day, checked every time
A copy every day
The database and every stored file are copied each day to a private store held in the EU, and each copy of the database is kept for 30 days.
Each copy restored
As soon as a copy is made it is restored into a separate database and checked table by table, so one that could not be restored is caught the same day.
Restores rehearsed
Bringing a store and its files back from a copy is rehearsed every quarter, so the steps are known before they are needed.
Found a security problem?
Tell us what you found and how to see it, and we reply, usually within one working day. Please give us a fair chance to fix it before you tell anyone else, and do not read, change or delete anyone else's data while you look.
Start with one store, free.
No card needed. Bring your orders in and see your real profit today.