Legal · for stores

Security

Last updated: 27 October 2026

What GroceryAI does to protect the data of stores and their customers. We list here only the measures the system has today and that we have verified; when we add one, we update the date at the top of the page.

Technical measures

Encryption in transit: Website, portal and service answer only over HTTPS, with HSTS (the browser never falls back to plain text).
Encryption at rest: The database is encrypted at rest by the provider (Supabase, AES-256).
Separation between stores: Every service table has row-level access rules (Row Level Security): one store's data cannot be read through another store's doors.
Portal access: Sign-in with an email link or code, or with a password; two-step verification available to everyone and mandatory when the store requires it; session in a cookie that page scripts cannot read; roles (owner, admin, developer, operator, read-only) with different permissions.
API keys: Shown only once; we keep only their fingerprint (hash). They can expire and be rotated without downtime.
Signed webhooks: Orders and support requests sent to the store's system are signed with HMAC-SHA256, with the secret of the receiving endpoint and the signing time.
Rate limits: The service endpoints have per-minute request limits: beyond the limit they reject the request (429).
Activity log: Every action in the portal (who, what, when, with which outcome) goes into a log that the service applications cannot change or delete; owner and admin read and download it.
Masked data: In the portal, customer conversations are shown with personal data hidden.
Backups: The database has a daily backup, kept by the provider for 7 days.
Protected portal pages: The portal loads only its own scripts (Content Security Policy) and cannot be framed by other pages.

Where the data is

The service database is in the European Union, in Stockholm. The text of the conversations also goes through the model provider (OpenAI, in the United States) and, for WhatsApp, through Meta; every provider, with its location and safeguards, is on the sub-processors page.

Organizational measures

Access to production systems is limited to people authorized by Aequus Ventures SRL and bound by confidentiality.
System credentials are kept in the providers' encrypted stores, never in the code.
Changes to the service are first tested on test benches with fake data and can be rolled back.
If we discover a breach of a store's data, we notify the store without undue delay and in any case within 48 hours, as the data processing agreement provides.

What we do not have yet

Today GroceryAI has no security attestation issued by third parties and no external assessment of its controls. The providers’ assurances are their own: you find them in their documents, linked from the sub-processors page.

Reporting a security issue

If you find a vulnerability, write to hello@groceryai.ai with the subject “Security”: we reply within 2 business days. Please do not access other people’s data and give us time to fix it before making it public.