Security

Authentication is handled via Supabase Auth. Workspace passwords must be at least 12 characters and include letters and numbers. Workspace roles limit who can connect integrations, edit targets, or send reports. Sessions can be revoked from the account side. Production database and hosting access is limited to authorized Ozeefy engineering staff.

Traffic is served over HTTPS (TLS). OAuth access and refresh tokens are treated as secrets: they are stored in our managed Postgres database, not exposed to browser clients, and protected by database role/column privileges and our cloud provider’s disk encryption. We do not claim a separate application-layer token cipher beyond those controls. Managed database backups from our cloud provider are encrypted.

Development and production environments are separated. We do not use production merchant data dumps as routine local fixtures. See our data loss prevention notes.

Meta, Google, Shopify and other connections use OAuth where available. You can disconnect an integration from the Integrations screen or the Shopify embedded App Home, which stops further sync and clears tokens. Shopify reporting rows are purged 90 days after disconnect. Shopify webhooks support customer data requests (delivered to the store owner), customer redaction, shop redaction, and app uninstall (/api/webhooks/shopify/compliance and /api/webhooks/shopify, HMAC-verified).

We keep application and integration audit logs for security-relevant events (integration connect/disconnect, compliance webhooks, retention purges). This is not a full enterprise staff-activity SIEM; production console access is limited to authorized engineers. Suspected incidents follow our incident response policy and escalate to security@ozeefy.com.

Access to production systems is restricted; secrets are not committed to source control; and export of merchant reporting data is limited to authenticated workspace users and authorized staff supporting those workspaces. Details: DLP notes. We do not operate a separate commercial DLP appliance.

Application and database hosting run on managed cloud providers with restricted production access for the Ozeefy engineering team.

Privacy Policy · Data Processing Addendum · Terms of Service

Email security@ozeefy.com. Please avoid public disclosure until we confirm a fix window.