Trust is the foundation of every successful online shop. Your customers need to know their data is safe — and you need to know your business is protected. Shopyai takes security and privacy very seriously and implements protection at every layer: transport, authentication, database, and payment processing.
SSL/TLS encryption at every layer
Every Shopyai shop automatically gets an SSL/TLS certificate — even with a custom domain. The certificate is automatically renewed, you do not need to manage anything. All data between your customers' browsers and the server is encrypted — just like a bank. This includes login credentials, personal information, order data, and payment information. Additionally, Shopyai enforces HTTPS for all connections — HTTP requests are automatically redirected.
GDPR, Austrian DSG 2018, and EU DSA — full compliance
Shopyai complies with three central European data protection regulations:
- EU GDPR — All customer data is stored in certified data centers in Germany. Data deletion on request, data export, consent management, and processing records are built in.
- Austrian DSG 2018 — As an Austrian company, Shopyai meets the national implementation of the GDPR with all additional requirements.
- EU Digital Services Act (DSA) — Transparent terms of service, complaint mechanisms, and content moderation for all shops on the platform.
Secure authentication with industry standards
Login to Shopyai runs through a certified identity management system with industry-standard security protocols. Sign in via Google, Facebook, or email — all encrypted. Security tokens have limited lifespans and are automatically refreshed. Passwords are never stored in plain text but hashed with modern algorithms. For added security, shop owners can enable two-factor authentication.
Multi-tenant isolation — strictly separated shops
Shopyai is a multi-tenant platform — all shops share the same infrastructure. But every shop is strictly isolated. All database queries are filtered by shop ID — no shop owner can see, modify, or delete another shop's data. Caches use tenant keys, and background jobs run in the respective tenant context. This isolation is continuously verified through automated tests.
Secure payments with Stripe PCI-DSS Level 1
Payments run through Stripe — PCI-DSS Level 1 certified, the highest security standard in the payments industry. Shopyai stores no credit card data. All payment processing happens on Stripe servers. Webhook signatures are verified on every callback to prevent man-in-the-middle attacks. Supported payment methods include credit card, Apple Pay, and Google Pay.
EU data residency
All data — customer information, orders, product data — is stored in certified data centers in Germany. Images are on European image servers with EU routing. There is no data transfer to third countries for core functions. This ensures your online shop meets all European requirements.
- Automatic SSL/TLS certificate for every shop
- GDPR, DSG 2018, and EU DSA compliant
- Secure authentication with 2FA option
- Multi-tenant isolation for every shop
- No credit card data on Shopyai servers
- Data residency in the EU (Germany)
All customer data is stored in certified data centers in Germany. Shopyai fully complies with GDPR, Austrian DSG 2018, and the EU Digital Services Act.
Conclusion
Security is not a feature — it is the foundation. At Shopyai, every layer is protected: transport with SSL/TLS, authentication with industry-standard protocols, data with multi-tenant isolation, and payments with Stripe PCI-DSS Level 1. Your customers can shop safely, and you can focus on your business.
FAQ
Where is my customers' data stored?
All customer data is stored in certified data centers in Germany. Images are on European image servers with EU routing. There is no data transfer to third countries for core data processing. This meets GDPR data residency requirements.
Does Shopyai store credit card data?
No, Shopyai does not store any credit card data. All payment processing runs through Stripe, which is PCI-DSS Level 1 certified. Credit card data is exclusively processed and stored on Stripe servers.
What happens when I delete my shop?
When a shop is deleted, all associated data is permanently removed — products, orders, customer data, and images. This process is irreversible and complies with the right to erasure (Art. 17 GDPR). You receive a warning and confirmation prompt beforehand.