How we protect your data

Where data lives

All customer data sits in Postgres at Supabase in Frankfurt and is processed by our services at Render in Frankfurt. We store no customer data outside the EU.

Backups: point-in-time recovery at Supabase plus a nightly dump that is verified automatically (size, row counts of the money tables). A restore drill is run every quarter.

Encryption

TLS everywhere. Secrets at rest (WordPress keys, Google connections, two-factor seeds, social tokens) are encrypted with Fernet and can be key-rotated without downtime. Passwords are hashed; API keys are stored only as hashes.

Access and roles

Agencies: owner/admin/member with two-factor. Clients: owner/editor/viewer, enforced centrally per request. Every agency sees only its clients; every client only its data — the AI memory included.

Portal sign-in uses single-use magic links (15 min). Sessions expire after 24 hours.

Outbound calls and webhooks

Everything we fetch from customer sites and feeds passes a filter that allows public addresses only and checks every redirect. Our webhooks are HMAC-signed and go to https only.

Payments

Card details never reach our servers — Stripe handles them. The credit ledger is append-only; no amount is edited after the fact, corrections are booked as new rows.

Data processing agreement

Our DPA is at /legal/dpa and forms part of the terms. Subprocessors are listed below; changes are announced 30 days ahead.

Vulnerabilities

Found something? Email security@shakeserp.com. We reply within two business days. The machine-readable policy is at /.well-known/security.txt.

Subprocessors