Skip to content

Security

Your store’s data,
kept safe.

How a request travels through Koomerce, and what protects it at every step. Every claim is backed by our engineering docs.

How a request is protectedSource: engineering docs · Security, Deployment, Backups
  1. ShopperBrowser or phone
  2. Cloudflare edgeTLS on every request
  3. Koomerce appsStorefront, admin, worker
  4. Access checkSession → role → 31 permissions
  5. Store isolationPostgres row-level security
  6. Encrypted secretsAES-256-GCM
  7. DatabaseMumbai · AWS ap-south-1
Encrypted backupsEncrypted · 7 daily + 4 weekly kept

In detail

Six things that keep you safe.

  • Hosted in India

    Production runs in AWS Mumbai (ap-south-1), close to your shoppers, payment partners and couriers.

  • Every store kept apart

    Postgres row-level security means one store’s data can never be read by another.

  • Encrypted secrets

    Payment and courier credentials and customer phone numbers are encrypted with AES-256-GCM.

  • Encrypted backups

    Backups are encrypted; 7 daily and 4 weekly copies are kept.

  • Roles and permissions

    Staff only see what their role allows — 31 separate permissions.

  • Your data, your call

    Download everything as one zip, or close your store for good. Built for the DPDP Act, 2023.

Found a security issue?

Write to support@koomerce.app with the details. Please test only on stores you own.

Email us