For stores and integrators

Trust

Last updated: 1 November 2026

What GroceryAI can show today about security, data protection and transparency, on one page. Every item links to the page that holds it, with its sources. We list only what exists and is true today.

Security

11 technical measures in place today, each one verified: HTTPS with HSTS, encryption at rest, row-level separation between stores, two-step verification, API keys kept only as a fingerprint, signed webhooks, rate limits, an activity log the service applications cannot change, masked conversations, daily backups, a Content Security Policy on the portal.

Security measures

Reporting a vulnerability

Our vulnerability disclosure policy says what is in scope, how to report and what we commit to: we reply within 2 business days. The contact is also published in our security.txt (RFC 9116).

Vulnerability disclosure policy

Data protection

  • The data processing agreement (Art. 28 GDPR), built on the Standard Contractual Clauses between controllers and processors (Decision (EU) 2021/915). If we discover a breach of a store’s data, we notify the store without undue delay and in any case within 48 hours.
  • The sub-processors: 8 providers process the data of stores and their customers and 1 only the website’s, each with what it does, which data, where and with which safeguards. Stores are told by email at least 30 days before a change.
  • The privacy policy and how to delete your data.

Where the data is

The service database is in the European Union, in Stockholm. Some providers, including the AI model provider, process data outside the EU. Where each one works, as the sub-processors page says:

  • Supabase: Database in the eu-north-1 region, in Stockholm (Sweden, EU). Functions run in the region closest to the caller; the portal asks for Frankfurt (eu-central-1).
  • OpenAI: United States. The assistant's requests are sent without stored state (store: false); abuse-monitoring logs are kept for at most 30 days.
  • Meta Platforms (WhatsApp Business Platform, Cloud API): Meta data centers; keeps messages for at most 30 days.
  • Vercel: Server functions in Frankfurt (Germany), pages from its worldwide network; primary processing facilities in the United States.
  • Cloudflare: Worldwide network, including outside the European Economic Area.
  • Resend: United States (Amazon Web Services infrastructure).
  • n8n: Frankfurt (Germany).
  • Google (Google Workspace): United States and Google's worldwide network.
  • Cal.com: United States.

Transparency of the AI

Replies are written by an artificial intelligence model and may contain errors; prices, totals and delivery slots come from the store’s systems. In the first message of every conversation the assistant says it is an AI assistant and where to read the store’s terms and privacy notice (Art. 50 of Regulation (EU) 2024/1689), as the service agreement states. The model provider does not use the conversations to train its models.

Architecture and data flows

Who sends data to whom when GroceryAI works for a store.

  1. Customers on WhatsApp

    • → Meta, WhatsApp Cloud API
    • → n8n, Frankfurt (stores connected through n8n)

  2. Customers on the store’s website

    • → Web chat widget or hosted chat page, straight to the service

  3. Store staff in the portal

    • → Cloudflare
    • → Vercel, Frankfurt (groceryai.ai/app)

  4. Store systems

    • → GroceryAI API, with an API key

GroceryAI service

  • Supabase: functions and database
  • Database in eu-north-1, Stockholm (EU)

OpenAI, United States

  • Reads the conversation and the catalog data needed, writes the reply
  • Not used to train models

Orders to the store

  • → Through the API or signed webhooks to the store’s system
  • → By email, through Resend (United States), for stores that choose it

Daily quality check: n8n (Frankfurt) and Google Sheets, on the first store’s conversations.

Each provider, with which data, where and with which safeguards, is on the sub-processors page.

What we do not have yet

Today GroceryAI has no security attestation issued by third parties and no external assessment of its controls. The providers’ assurances are their own: you find them in their documents, linked from the sub-processors page.

Contact

For any question about security or data: hello@groceryai.ai. Aequus Ventures SRL, Olbia, Italy, develops and owns GroceryAI.

security.txt