# Security at ShopSavvy

> What we do to protect your account and the data you get from us, stated as facts you can check. If you need something that is not here, email business@shopsavvy.com.

*Source: https://shopsavvy.com/security*

*Last reviewed 2026-10-12*

---

## Where data is hosted

- ShopSavvy's API, website and database run on DigitalOcean in its San Francisco region (sfo3), in the United States.
- We do not offer EU or other regional data residency. The services listed under Sub-processors below run on their own infrastructure.

## Encryption in transit

- shopsavvy.com and api.shopsavvy.com accept TLS 1.2 and TLS 1.3 and refuse TLS 1.1 and older.
- Plain HTTP requests are redirected to HTTPS.

## API keys

- Data API keys are bearer tokens sent in the Authorization header.
- Keys are stored as hashes, not in plain text, so we cannot read a key back after it is issued. A new key's secret is shown once.
- You can create, regenerate and revoke keys yourself in the developer dashboard. Regenerating a key stops the old secret working immediately.
- Each account is limited to 1,000 requests per rolling hour per account; requests over the limit get HTTP 429 with a Retry-After header.

## Webhooks

- Every webhook delivery is signed: the X-ShopSavvy-Signature header carries a timestamp and an HMAC-SHA256 of the timestamp and body, computed with your webhook's secret.
- Deliveries are retried up to five attempts, and each event carries a stable id so you can ignore repeats.
- Webhooks created in the developer dashboard must use an HTTPS URL.

## What we store about API customers

- Your account (email address and sign-in), your API keys (hashed) and your subscription status. Card details are held by our payment processor, not by ShopSavvy.
- A log row per API request: key id, endpoint, method, response code, error code, credits used, timestamp, request id, IP address and user agent.
- Request log rows are deleted after about 13 months. Our web servers also keep standard access logs, which include request URLs.

## Licensed and API data contain no personal data

- Data API responses and Data Licensing exports contain product and offer data only: identifiers, product attributes, retailer, price, availability, condition and timestamps.
- They never contain user identifiers, names, contact details, location or behavioural data such as searches, scans or purchases. Licensed exports are produced from a fixed column whitelist.

## Backups and recovery

- The production database is backed up daily to off-site object storage. Each backup is a complete, standalone copy, and older copies are only removed after a newer one has been verified as fully uploaded.
- Backups run every day, so a restore normally loses no more than the last day of changes.
- A documented rebuild of the production server from backups was tested end to end on a fresh server on 2026-07-30.

## Sub-processors

- DigitalOcean: hosting, database and backup storage (US).
- Stripe: payments and billing.
- Google Firebase: account sign-in.
- Amazon Web Services (Simple Email Service): transactional email.
- Google Analytics: website analytics.
- This list covers vendors that process personal data about our customers. Product and price data is not personal data.

## Certifications

- ShopSavvy does not hold SOC 2 or ISO 27001 certification.
- For security questionnaires or contract terms, email business@shopsavvy.com.

## Reporting a security issue

- Email business@shopsavvy.com with "Security" in the subject. Please include steps to reproduce, and give us reasonable time to fix the issue before disclosing it.
- Service status: shopsavvy.com/status.