Security at ShopSavvy
What we do to protect your account and the data you get from us, stated as facts you can check. If you need something that is not here, email business@shopsavvy.com.
Last reviewed
Where data is hosted
- ShopSavvy's API, website and database run on DigitalOcean in its San Francisco region (sfo3), in the United States.
- We do not offer EU or other regional data residency. The services listed under Sub-processors below run on their own infrastructure.
Encryption in transit
- shopsavvy.com and api.shopsavvy.com accept TLS 1.2 and TLS 1.3 and refuse TLS 1.1 and older.
- Plain HTTP requests are redirected to HTTPS.
API keys
- Data API keys are bearer tokens sent in the Authorization header.
- Keys are stored as hashes, not in plain text, so we cannot read a key back after it is issued. A new key's secret is shown once.
- You can create, regenerate and revoke keys yourself in the developer dashboard. Regenerating a key stops the old secret working immediately.
- Each account is limited to 1,000 requests per rolling hour per account; requests over the limit get HTTP 429 with a Retry-After header.
Webhooks
- Every webhook delivery is signed: the X-ShopSavvy-Signature header carries a timestamp and an HMAC-SHA256 of the timestamp and body, computed with your webhook's secret.
- Deliveries are retried up to five attempts, and each event carries a stable id so you can ignore repeats.
- Webhooks created in the developer dashboard must use an HTTPS URL.
What we store about API customers
- Your account (email address and sign-in), your API keys (hashed) and your subscription status. Card details are held by our payment processor, not by ShopSavvy.
- A log row per API request: key id, endpoint, method, response code, error code, credits used, timestamp, request id, IP address and user agent.
- Request log rows are deleted after about 13 months. Our web servers also keep standard access logs, which include request URLs.
Licensed and API data contain no personal data
- Data API responses and Data Licensing exports contain product and offer data only: identifiers, product attributes, retailer, price, availability, condition and timestamps.
- They never contain user identifiers, names, contact details, location or behavioural data such as searches, scans or purchases. Licensed exports are produced from a fixed column whitelist.
Backups and recovery
- The production database is backed up daily to off-site object storage. Each backup is a complete, standalone copy, and older copies are only removed after a newer one has been verified as fully uploaded.
- Backups run every day, so a restore normally loses no more than the last day of changes.
- A documented rebuild of the production server from backups was tested end to end on a fresh server on 2026-07-30.
Sub-processors
- DigitalOcean: hosting, database and backup storage (US).
- Stripe: payments and billing.
- Google Firebase: account sign-in.
- Amazon Web Services (Simple Email Service): transactional email.
- Google Analytics: website analytics.
- This list covers vendors that process personal data about our customers. Product and price data is not personal data.
Certifications
- ShopSavvy does not hold SOC 2 or ISO 27001 certification.
- For security questionnaires or contract terms, email business@shopsavvy.com.
Reporting a security issue
- Email business@shopsavvy.com with "Security" in the subject. Please include steps to reproduce, and give us reasonable time to fix the issue before disclosing it.
- Service status: shopsavvy.com/status.
Related: Status · Pricing · Privacy policy · Terms of use · security.txt