Enterprise plumbing. None of the drama.

Every row in our data model is scoped to a `store_id`. There's no cross-store query path in the application code — the embedding index, conversation history, customer records, and journey state are all keyed on store_id. Database connection pool is shared but every query carries the scope as a WHERE predicate.

App-level encryption uses a derivation from DATA_ENCRYPTION_KEY (falling back to AUTH_SECRET / NEXTAUTH_SECRET if unset). Shopify access tokens, WooCommerce plugin tokens, and connector credentials live encrypted at rest in the `stores.access_token` column and related fields. Verification uses constant-time compare so timing attacks aren't a concern.

We ship a dedicated GDPR worker. Shopify webhook callbacks for data request, data erasure, and shop redact route through it; for WooCommerce the plugin exposes equivalent endpoints. The worker runs with 5 retries on exponential backoff so a failed external API call doesn't silently drop a legal obligation. Privacy and DPA generators are also bundled.

All public endpoints — the merchant dashboard, the widget, the webhook ingress, the public REST API — terminate TLS at the edge. Connections to Postgres go over SSL. Internal worker traffic to Redis runs over a private network.

Primary data lives in Postgres (with pgvector for embeddings) in the region you select on signup. EU and US regions are available; we'll add APAC if a customer pushes us there. Redis backs the queue and can be co-located with Postgres for latency.

Yes. Every dashboard action — invites, role changes, integration credential rotation, journey publish, knowledge upload, erasure request — emits an audit event with actor, action, target, and timestamp. The log is exportable per-tenant.

Cloudflare Turnstile gates conversation start on suspicious traffic patterns. Optional and configurable per store. Behind the proxy, rate limits on every public endpoint (Upstash-backed) prevent abuse from burning AI tokens.

Absolutely. We provide a security questionnaire packet on request, plus a DPA, sub-processor list, and a runbook for shared incident response. Enterprise contracts include named contacts and an annual review cadence.