The safest buyer data is the data we never store.
Margixa handles commerce data for a living. Security is not a checklist we filled in afterwards · the platform's core privacy decision (never store buyer data) was made on day one, and everything below builds on it.
Last updated 21 September 2026
Zero buyer data stored. Privacy by design.
The strongest protection for buyer personal data is not storing it.
- Marketplace orders are mirrored without buyer identity · order numbers, line items and amounts only.
- The buyer's name and address are fetched from the marketplace at the moment of fulfilment and used in memory to produce the shipping label · the label PDF itself is the only place an address is kept, in a private bucket, and it is deleted after 7 days.
- There is no buyer-PII table to breach, export or leak · not in the database and not in the logs.
- Invoices follow the same model · your identity, the lines and a PDF fingerprint are kept · buyer details are merged live on re-download.
How we protect it. Seven areas, every point.
Fully managed cloud · EU regions
The application and the database run in Ireland on certified providers, with an encrypted copy every night in Germany.
- Vercel (application) · Supabase (PostgreSQL and authentication · ISO 27001 and SOC 2 Type II certified) · Railway (background workers) · all SOC 2 certified providers, audited annually · the application and the database both run in Ireland.
- Point-in-time recovery on the database, plus an encrypted off-site copy every night in Germany · restores are tested every six months.
- The database is never publicly reachable · access flows through the platform's API layer only · service keys are restricted to backend workers.
- No self-managed servers, file stores or desktop endpoints hold customer data.
Encryption and key management
Everything is encrypted in transit and at rest. Marketplace and carrier keys get an extra layer that only our backend can open.
- All traffic encrypted in transit with TLS · data at rest encrypted with AES-256 by the database provider.
- Marketplace and carrier API credentials get an extra application-level layer · sealed with libsodium public-key encryption (X25519 / XSalsa20-Poly1305). The web application can only encrypt · decryption keys exist solely in the backend worker environment's managed secret store.
- No secrets live in source code or repositories.
Tenant isolation and access control
Each merchant's data is walled off by the database itself. Named accounts, two-step sign-in for everyone and permissions per module.
- Every merchant's data is isolated with database-enforced row-level security · isolation is a property of the database itself, not just the application code.
- Role-based access with per-module permissions · staff see only what their job requires · order-fulfilment roles are the only ones that can trigger the transient buyer-data fetch · permission changes reach the employee's screen in moments.
- Individual named accounts only · no shared logins · two-factor authentication required for every user · passwords of at least 12 characters that expire yearly · centrally revocable sessions · every new workspace is reviewed by MARGIXA before it goes live.
Monitoring, logging and audit
Every scan, grade, move and shipment carries the person and the time. Outages, failed jobs and provider errors raise an alert.
- Application-level audit trails cover staff actions, inventory movements, pricing pushes and channel events · tied to the individual account · every scan, grade, move and ship carries the person and the time.
- Automated health monitoring alerts on worker outages, failed jobs and provider errors · structured logs across all services · Supabase security advisors run against every schema change.
- Logs are reviewed on a scheduled cadence · security events escalate to a named incident contact.
Development practices
Nothing is released without passing type checks, linting and a full build. Testing uses synthetic data only.
- Strict type-checking, linting and a full production build must pass before anything is released.
- Continuous dependency scanning · critical advisories are patched and deployed immediately.
- Changes are exercised in dedicated test environments (test tenants, sandbox marketplace accounts, preview deployments) with synthetic data only · production buyer data is never used in testing.
Incident response
A written plan, reviewed every six months, with the notification windows of the marketplaces and of GDPR.
- A documented incident-response plan with defined roles, reviewed every six months.
- Detect and triage · contain (revoke credentials, isolate the service, rotate keys) · assess scope · notify affected parties and marketplaces within their required windows (including Amazon within 24 hours where Amazon data is involved) and authorities per GDPR timelines · recover · close with a post-incident review.
Included on every plan · never an upgrade
Every control on this page is on every plan. Security is not a tier.
- Every control on this page ships to every merchant on every plan · security is not a tier.
- Built to pass marketplace partner requirements, the Shopify App Store review and Amazon-grade security questionnaires.
Marketplace compliance. How each connection is authorised and what it may touch.
Back Market
Seller API integration
Official seller-API integration, live in production · credentials sealed per merchant · buyer PII fetched live at fulfilment only, never stored.
Refurbed
Integration partner
Official merchant-API integration, live in production · orders, offers, customer care and shipping labels · buyer PII fetched live at fulfilment only.
Shopify
Live · the merchant installs a custom app in their own Shopify admin and approves its scopes · protected customer data handled per Shopify's requirements.
WooCommerce
Live · connects through the merchant's own store API keys with granular permissions, fully under the merchant's control.
bol.com
Live · merchant Retailer API keys · refurbished offers, open orders and stock · no partner agreement required on the merchant's side.
Magento 2 · CCV Shop · Lightspeed C-Series
Live · merchant-issued keys from the store's own admin, sealed per merchant · orders, shipments and stock.
Amazon
Live · registered Selling Partner API developer · the seller connects through Amazon's own authorization page · orders are read without buyer data · built to Amazon's Data Protection Policy and Acceptable Use Policy.
Carriers
Sendcloud · MyParcel · DHL eCommerce Benelux · DHL Express Commerce · the merchant's own contracts · label PDFs stored in a private bucket, served only through tenant-checked signed links and deleted after 7 days.
Found a vulnerability? We want to know.
Email integrations@margixa.com · we respond promptly · please avoid accessing merchant data and give us reasonable time to remediate before disclosure.
Report it