Security and trust

You’re trusting us with your store, your ad account and your customers. Here is exactly how we look after them.

Payments by Stripe

Card details are entered on Stripe’s secure checkout and never reach our servers. Stripe is certified to PCI Service Provider Level 1, the highest level in the payments industry.

Keys, not passwords

We connect to your store and Meta account with access keys you create and can revoke at any time. We never ask for your store or Facebook password.

Encrypted at rest and in transit

Every page and connection uses HTTPS. Store and ad account keys are encrypted in our database with a key kept outside it.

Changes you can trace

Every product change is logged with what it was before. Products are hidden, never deleted, so any change can be undone.

Human approval where it matters

Large price changes, products without prices, uncertain listings and every ad campaign wait for a person to approve them.

You own everything

Your store, products, ad account and customer data stay in your accounts. If you cancel, nothing is taken with us.

How we handle your data

Least access. Each client portal shows only that business’s data. Our staff access client data only to deliver the service or when you ask for help.
Accounts. Passwords are stored as one-way hashes, changing a password signs out every other device, and email changes notify the old address.
Photos. Product photos you upload are stored privately and shared with your store platform through unguessable links so it can download them.
AI processing. Photos and sheets are sent to our AI provider only to write your listings, under terms that don’t allow them to train on your data. See our Privacy Policy for every service provider we use.
Cookies. We only use the cookies needed to log you in and keep forms secure, unless you agree to more. See our Cookie Policy.

Report a security issue

If you think you’ve found a security problem, email autopilot@rsap.dreamrocketdesign.com. Please give us a reasonable chance to fix it before sharing it publicly. Our security.txt lists the same contact.