Security at Vericog
Dealers trust Vericog with the operating data of businesses that move six and seven figures of inventory. Here is, concretely, how that data is protected.
Tenant isolation
Every record in Vericog is scoped to your account. Cross-tenant access is enforced at the query layer and covered by our automated test suite, including dedicated tests for cross-tenant access attempts.
Encryption
All traffic is TLS-encrypted in transit. Marketplace credentials, including eBay tokens and Shopify access tokens, are encrypted at rest. API keys are never stored in plaintext: we keep only a SHA-256 hash, and the Shopify connector encrypts its stored credentials with AES-256-GCM.
Webhook integrity
Marketplace webhooks are HMAC-signature-verified, twice and independently for Shopify traffic (once at the connector, again at our backend). Replayed deliveries are detected and processed exactly once. Requests are rate-limited per account.
Payments
Subscriptions are processed by Stripe. Card details go directly to Stripe and are never stored on Vericog's servers.
Privacy & GDPR
Vericog authenticates mandatory Shopify privacy webhooks, associates each request with the verified store, encrypts it at rest, and tracks it in a daily-audited queue for verified manual fulfillment. A shop-redaction request immediately revokes that store's credentials, but Vericog does not run partial account-wide exports or erasures automatically. See our privacy policy for how we handle data generally.
Infrastructure
Application data lives in PostgreSQL; images are stored on Cloudflare R2. Account activity is logged in an audit trail visible in your settings. For how our market data is collected and computed, see the data methodology.
Multi-factor authentication
Every account can enable TOTP two-factor authentication (Google Authenticator, 1Password, Authy) with single-use recovery codes. Secrets are encrypted at rest, and enabling, disabling, or regenerating codes is recorded in your account's audit trail.
What we're honest about
We don't yet hold formal certifications (SOC 2 / ISO 27001). If that's a requirement for your business, tell us. It moves the roadmap.
Security questions or reports
Email [email protected]. Security reports are read first and answered fastest.