Security

Platform access

• Platform tokens are stored server-side only, envelope-encrypted with AES-256-GCM using a separate data key per record, and never written to logs.
• Connections use OAuth with single-use state and PKCE to prevent forged or replayed authorizations.
• Permissions are separated by capability; we request only the permissions features actually use.

Isolation and access control

• Each organization's and business's data is isolated at both the application and database-constraint level, with tenant-isolation tests on every code change.
• Access is controlled by roles and permissions (RBAC) within each organization.
• Significant actions are recorded in an append-only audit log.

Data integrity

• Platform webhooks are signature-verified before storage and protected against replay.
• Original platform data is kept as immutable evidence with SHA-256 integrity checks.
• Actions on platforms must pass guardrails and approvals, and results are verified after execution.

Infrastructure and development

• Production data is hosted with managed cloud providers, encrypted in transit (TLS) and at rest.
• Development and test environments never use real merchant data.
• Every code change passes automated tests, secret scanning and dependency vulnerability checks before release.

Reporting a security issue

If you find a vulnerability, email support@ceoneq.com with the subject "Security", including details and steps to reproduce. We will acknowledge and keep you updated.

Please do not access or modify other people's data, do not disrupt the Service, and give us time to fix the issue before public disclosure.