Security
Security practices built into the platform. Independent certifications (such as SOC 2) have not been completed; we will publish them here when they are.
Payment data
Card details are entered on Stripe-hosted pages and never reach ModernShop servers. We store only Stripe references.
Tenant isolation
Every database query is scoped to a store, and staff permissions are checked on the server for every page and action.
Accounts
Passwords are hashed with bcrypt. Sessions are random, stored hashed, httpOnly and revocable; password resets revoke all sessions. Sign-in attempts are rate limited.
Webhooks
Stripe webhooks are verified against their signature and de-duplicated, so replays can never create duplicate orders or refunds.
Financial integrity
Totals are computed on the server from database prices, money is stored as integer cents, and the payment ledger is append-only.
Browser protections
A Content Security Policy, HSTS, frame-ancestors denial and strict referrer policy are sent on every response.
AI
AI output is treated as untrusted. It can only produce previews; consequential changes always require a human action.
Found a vulnerability? Please report it responsibly to the platform operator's security contact.