How Verdikx keeps your data secure
Encryption, database isolation, two-factor sign-in, card data, subprocessors and how to report a security issue.
Where in VerdikxSecurity page (verdikx.com/security)
What protects your data
- All traffic uses HTTPS, and browsers are told never to connect over plain HTTP.
- Shopify access tokens and the credentials of services you connect are encrypted before they're stored (AES-256-GCM). API keys are kept only as hashes.
- Database row-level security keeps each account to its own records. When two-factor sign-in is on, the database enforces it too.
- Verdikx never receives full card numbers: only the card brand, BIN and last four digits where your store or processor provides them.
Certifications and paperwork
- SOC 2 is on our compliance roadmap (Verdikx does not hold a SOC 2 report today). Security questionnaires are available on request.
- The Trust Center lists our legal documents, including every provider (subprocessor) that processes data for Verdikx.
- Need a signed DPA? The Data Processing Addendum is listed in the Trust Center; contact us to execute a signed copy.
Report a security issue
Email security@verdikx.com with the affected page or feature and steps to reproduce. The full details are on the Security page.