Workspace isolation
Every workspace’s data is separated by PostgreSQL row-level security, enforced for every table that holds customer data, and covered by automated isolation tests.
Security
How we protect your store data
These are the practices built into Nedovi today. Nedovi does not currently hold third-party security certifications; we describe what we do rather than badges we don’t have.
Encrypted connections and tokens
Shopify and DSers access tokens are encrypted at rest with AES-256-GCM envelope encryption and are never shown again after connecting. Traffic to the site is served over HTTPS.
Sign-in protection
Passwords are hashed with scrypt. Two-factor authentication (authenticator apps) with recovery codes, session management, and rate limiting on sign-in.
Least change by default
Supplier data is read-only. Changes to your Shopify store are queued for approval by an owner or admin before anything is sent.
Audit log
Important actions — approvals, settings changes, connections, exports — are recorded in an append-only audit log visible to owners and admins.
Your data, your exit
Owners can export workspace data at any time (credentials are never exported) and schedule workspace deletion with a grace period.
Reporting a vulnerability
Email [email protected] with the subject “Security report”. Please give us reasonable time to fix an issue before disclosing it, and don’t access other people’s data while testing.