Trust & security

Security at StorePilot

Last updated: July 28, 2026 · Questions: security@storepilothq.com

StorePilot connects to the systems that run your business, so security isn't a feature — it's the product. We designed it around two principles: read only what we need, and never change anything or spend money without your explicit approval.

The money-gate

Every action that spends money or edits a live listing — a reprice, a refund, an ad-budget change — is paused before it executes and requires your explicit approval. The default autonomous spend limit is $0; you opt in to any automation, per rule, on your terms. Refund auto-approval, where you enable it, applies only below a threshold you set and only once the returned item is confirmed back. Every decision is written to an immutable audit log.

Data protection

• Encryption in transit: all traffic uses TLS 1.2+.
• Encryption at rest: data and backups are encrypted with AES-256.
• Token vault: the OAuth tokens that connect your stores are held in a dedicated, encrypted secrets store — never in plaintext configuration or source control.
• No buyer PII at rest: buyer names and addresses stay on the marketplace they live on. When an operation needs them, we read them live and do not warehouse them.
• Retention & deletion: we keep only what's needed to operate the service, and honor deletion requests. Disconnect a store and its access is revoked.

Access & authorization

• Least privilege: each marketplace is authorized with the minimum scopes required — read-only wherever possible.
• You grant, you revoke: you connect each channel through its official OAuth flow and can revoke StorePilot's access at any time from the platform.
• Tenant isolation: every customer's data and credentials are isolated per tenant.
• Never RAG live state: live inventory, orders and ad spend are read fresh from each platform at decision time — we never answer a "right now" question from a cached or stale copy.

Operational security

• Passwordless sign-in: access is via short-lived, cryptographically signed magic links — there are no passwords to steal. Administrative access is invite-only and role-restricted, separate from customer access.
• Application and access logs retained for review of abnormal activity.
• A documented incident-response plan with defined roles, reviewed every six months: on a suspected compromise we revoke affected tokens, rotate keys, and notify affected customers and the impacted marketplaces within 24 hours of detection.
• Regular dependency and vulnerability review.

Sub-processors

We use a small set of vetted sub-processors under data-processing agreements. Current list:

Provider	Purpose
Anthropic (Claude)	The reasoning model behind the agent
Cloud hosting provider	Application hosting & encrypted data storage
Encrypted secrets manager	Encrypted OAuth token vault

Responsible disclosure

Found a vulnerability? We want to hear from you. Email security@storepilothq.com with details and we'll respond promptly. Please give us reasonable time to remediate before public disclosure.