Security
Your business data, kept apart and locked.
Orders, customers, costs and payouts are the most private numbers a business has. This page says plainly how Merchvio protects them, and what we have not done yet.
- A database per workspace. Each business has its own database and its own folder for files. Nothing is kept in a shared table.
- An encryption key per workspace. Personal data, messages, finance notes, secrets and files are encrypted with your workspace's own key.
- Encrypted backups. Backups are encrypted and checked before any restore.
- Two-step sign-in. Authenticator app codes, recovery codes and trusted devices.
- Access person by person. Roles, teams and grants down to a warehouse, a channel or a column.
- A log that shows tampering. Every sign-in and change is written to a chained audit log.
Isolation
When you sign up, Merchvio creates a new workspace with its own database, its own encryption key and its own storage folder. Your workspace is chosen by a signed cookie when you sign in, and a forged or old cookie is ignored. Automated tests check on every release that one workspace cannot read or decrypt another's data.
Encryption
Data travels over HTTPS only, with HTTP Strict Transport Security. At rest, sensitive fields are sealed with authenticated encryption (libsodium secretbox, XSalsa20-Poly1305). Separate keys for personal data, messages, finance text, secrets and files are derived from your workspace key with HKDF-SHA256, so one key reveals nothing about another. Each value is bound to its table, column and row, so a value copied elsewhere will not open. Uploaded files are encrypted in chunks, with protection against truncation.
Amounts, quantities, dates and SKUs stay readable to the database so it can total and sort them. Exact searches on encrypted email and phone fields use keyed hashes, never the plain value.
Backups
Owners can take an encrypted backup at any time, schedule them, and download them. A backup carries checksums for every table, and a restore checks them and takes a safety copy first. Server-level backups are also kept by our hosting provider.
Signing in
Passwords are hashed with Argon2id. Two-step sign-in uses codes from an authenticator app, with one-use recovery codes. Sign-in is rate-limited per address and per account, in a way that stops someone locking you out by guessing. You are told when your account signs in from a new device, and sensitive actions ask for your password again.
Access control
The owner decides who can do what. Permissions can be limited to a warehouse or a channel, and costs, pay and bank details can be hidden column by column. Nobody can grant a permission they do not hold themselves.
Audit log
Sign-ins, permission changes, postings, refunds, exports and other important actions are written to an append-only log. Each entry is chained to the one before with SHA-256, and an integrity check shows if anything was altered.
The website and the app
Pages load no third-party scripts, fonts or trackers. A strict content security policy blocks injected scripts, and every form carries a token against cross-site requests. Card payments for subscriptions happen on Stripe's own checkout page, so card numbers never reach our servers.
Testing
Every page and route is tested for access control, cross-site scripting, SQL injection and web security settings before each release, and those tests run again on every release since.
That is our own testing, not an independent audit. We will publish the results of independent testing on this page when we have them.
Your data, your rules
Export everything at any time, on every plan. After you cancel, you can still sign in and export for 30 days; after that the workspace is deleted.
We use a small number of other companies to run the service. They are listed on the sub-processors page, and our Data Processing Agreement sets out how we handle the personal data you keep with us.
Report a security problem
If you think you have found a vulnerability, email support@merchvio.com with the subject "Security report". Include the steps to reproduce it. We will reply, keep you updated and credit you if you wish.
Please test only against your own workspace, do not access or change other people's data, do not run denial-of-service or spam tests, and give us reasonable time to fix the problem before telling anyone else. We will not take legal action against research done in good faith within these rules.
Start your free trial
See your real profit this week.
Connect a channel or upload a spreadsheet of orders. 14 days free, no card needed, cancel online at any time.