At a glance
In short: data is stored in Brazil, each store sees only its own data, everything travels encrypted, and access to your store platforms is stored encrypted. If something goes wrong, we tell you within 48 hours of becoming aware of it.
This page explains our safeguards in plain language. The full technical list is in Annex II of the Data Processing Agreement. The suppliers that process data are listed under Sub-processors.
Your data is stored in Brazil
In short: the database and files are stored in São Paulo, and the app runs there. Background jobs and some suppliers' technical logs run in the United States.
That keeps your store's data close to you, makes the app faster, and keeps storage under Brazilian law.
- The database and files are on Supabase, in São Paulo.
- The app and its functions run on Vercel, in São Paulo.
- Your store's emails are sent through Amazon SES, in São Paulo, from activation of the email channel.
Some suppliers process data in the United States, such as error logging and background jobs. The Sub-processors page shows which ones, what data, and under what legal safeguard.
Each store sees only its own data
In short: stores are separated by the database itself, not just by the screens.
Even if a screen had a bug, the database would not return another store's data.
- Every data table has row-level security enabled, and every row belongs to one store.
- Background jobs filter by store explicitly.
- Files are stored in separate folders per store. Payment receipts live in a private bucket and open only through a link that lasts 60 seconds.
Encrypted in transit and at rest
In short: no one in between can read what travels back and forth, and what is stored is encrypted.
- The website, the app and the APIs accept HTTPS connections only, with TLS 1.2 or 1.3.
- The database is encrypted at rest by the provider, with AES-256.
Access to your store, under lock and key
In short: the keys that give access to your Shopify or Nuvemshop store are never readable in the database.
- Store platform access tokens are encrypted with AES-256-GCM before they are saved, with the key kept outside the database.
- The same applies to the secrets that sign your outbound webhooks.
- Connecting a platform (OAuth) uses an encrypted state that expires in 10 minutes, so no one can hijack the installation.
Everyone sees only what they need
In short: your team has roles, and more sensitive data is locked down further.
- Stores have administrator and member roles.
- Creators' payout details (Brazilian CPF or CNPJ and Pix key) are kept in a separate table. Only administrators can see them, and only after the creator accepts the store's agreement.
- Passwords are kept only in the authentication service, never in our tables, and must be at least 10 characters long. You can also sign in with a magic link or with Google.
- The activity log shows who performed each operation in the store.
What comes in and goes out is verified
In short: we only accept notifications that really come from your platform, and what we send you can be verified.
- Notifications from Shopify and Nuvemshop are verified by signature (HMAC) before they are accepted.
- Webhooks Vertia sends to your systems are signed, so you can check where they came from.
- When we fetch images from outside, we only accept HTTPS to public addresses, with no redirects. That stops anyone from using Vertia to reach our internal network.
Email under your brand, authenticated
In short: your store's email is sent from your own domain, with the signatures mailbox providers require.
The email channel is only activated with these safeguards:
- Sending uses your store's own domain, authenticated with DKIM (2048-bit key), SPF on a dedicated subdomain, and DMARC. That makes it harder for anyone to impersonate your store.
- Every marketing email includes one-click unsubscribe.
- The email provider's click tracking is turned off: links in your emails never go through a third-party domain.
Errors monitored without personal data
In short: when something breaks, we see where it broke, not the data of whoever was using it.
- Error logging (Sentry) receives no names, emails, IP addresses, cookies, headers or request content. The error message is replaced with generic text, leaving only the code path and technical identifiers.
- App logs keep identifiers and reasons, never the data itself.
- The website and the app use no analytics tools, pixels or third-party cookies.
Deletion that really deletes
In short: when data has to go, it goes, including from file storage.
- Deletion requests for a customer, from Shopify, Nuvemshop or made to us in writing, remove that customer's personal data. Their orders stay in the store's records, without name or contact details.
- When a store is deleted, we also delete its files.
- A minimal record of each deleted customer stops them from coming back in a later import.
- Creator payment receipts are deleted automatically 90 days after upload.
How we tell you about incidents
In short: if a security incident affects your store's data, we tell you within 48 hours of becoming aware of it.
- Timing. Within 48 hours of Vertia becoming aware. That leaves you room to meet your own deadlines with Brazil's ANPD (3 business days) and EU supervisory authorities (72 hours).
- Channel. Email to the store administrator and a notice in the dashboard.
- Content. What happened, which data and how many people were affected, the likely consequences, what we have done, and who can tell you more. Anything we don't know yet, we send in stages.
- Afterwards. We help you notify authorities and data subjects, and we keep a record of every incident.
The contractual details are in section 11 of the Data Processing Agreement.
Report a vulnerability
In short: found a flaw? Email seguranca@usevertia.com. We acknowledge your report within 3 business days and will not take legal action over good-faith research.
How to report. Email seguranca@usevertia.com, in English or Portuguese, with:
- where the flaw is (URL, screen or API);
- steps to reproduce it;
- the impact you see;
- how to reach you, if you'd like a reply.
What we do.
- Acknowledge receipt within 3 business days.
- Assess and fix the issue, and keep you updated at least every 10 business days until it is fixed.
- Agree with you on when the issue can be disclosed.
- Credit you for the finding when we disclose the fix, if you'd like.
Coordinated disclosure. Please don't disclose the flaw before it is fixed, or before the date we agree on together.
Safe harbor. If you act in good faith and follow the rules below, we consider your research authorised. We will not sue you or file a criminal complaint over it. If anyone takes action against you over research done this way, we will make clear that it was authorised.
Research rules.
- Test only with your own account and your own test store.
- Don't access, copy, change or delete other people's data beyond the minimum needed to prove the flaw. If you come across personal data, stop, tell us, and delete what you obtained.
- Don't send messages to real customers or use Vertia to send email or WhatsApp messages to third parties.
- Don't run denial-of-service tests or any test that disrupts the service.
- Don't use social engineering or phishing against our team or our customers, and don't run physical tests.
- Tell us as soon as you find the flaw.
This safe harbor covers Vertia's systems only. It does not authorise testing of third-party systems such as Shopify, Nuvemshop, Meta or our suppliers. For those, follow each one's own rules.
Our security contact is also published at /.well-known/security.txt.