Security
Your numbers are your business. We treat them that way.
ProfitIQ holds your orders, costs and ad spend. This page describes the controls that protect them, in plain terms and without badges.
Controls
What protects your data
Encrypted in transit and at rest
Every connection uses HTTPS with strict transport security. The access tokens and API keys for your stores and ad accounts are encrypted with AES-256-GCM before they are stored. The database is encrypted at rest by our database provider, and nightly backups are encrypted by ProfitIQ (AES-256) before they are stored.
Your business is isolated from every other
Row-level security in the database ties every record to one business, and every request is checked against it. One business’s data cannot be read or changed from another’s account.
Read-only connections
Store and ad connections request reporting access only. ProfitIQ reads orders, products and ad spend; it does not edit your listings, prices or campaigns.
Access you control
The owner gives each teammate a role and switches individual sections on or off, enforced on the screens and again behind them. Settings, Team and API keys are owner-only. Removing someone cuts their access at once.
Verified machine traffic
Webhooks from your stores are accepted only with a valid signature, scheduled jobs only with a secret, and every connection callback only with a one-time state value. Requests are rate limited per person and per business.
A record of what happened
An audit log records who did what, and every change to the money on an order is kept with its old value, new value, time and cause. Production errors are monitored without personal data.
Hardened by default
A strict content security policy limits what any page can load and where it can send data. Framing by other sites is blocked, and the site is served with the standard browser-protection headers.
Your data, deletable
The owner can erase orders, products, marketing data, customers, suppliers or everything from Settings, immediately and permanently. Nightly encrypted backups protect against loss; deletion requests from Shopify are honoured.
Data minimisation
What ProfitIQ keeps from your store
We keep what profit needs and no more.
Orders and refunds
- Stored:
- Yes
- Why:
- To calculate profit. Includes line items, amounts, fees and status.
Products and costs
- Stored:
- Yes
- Why:
- To cost orders and value stock.
Ad spend and campaigns
- Stored:
- Yes
- Why:
- Read-only reporting data, to calculate profit after ads.
Customer name and city
- Stored:
- Yes
- Why:
- The order’s display name, repeat-return flags, and courier analytics by city.
Customer email, phone, street address
- Stored:
- No
- Why:
- Not collected or stored from your store.
Store and ad-account credentials
- Stored:
- Encrypted
- Why:
- AES-256-GCM before storage; deleted when you disconnect.
| Data | Stored | Why |
|---|---|---|
| Orders and refunds | Yes | To calculate profit. Includes line items, amounts, fees and status. |
| Products and costs | Yes | To cost orders and value stock. |
| Ad spend and campaigns | Yes | Read-only reporting data, to calculate profit after ads. |
| Customer name and city | Yes | The order’s display name, repeat-return flags, and courier analytics by city. |
| Customer email, phone, street address | No | Not collected or stored from your store. |
| Store and ad-account credentials | Encrypted | AES-256-GCM before storage; deleted when you disconnect. |
Your customers’ personal data is yours: you are the controller and ProfitIQ the processor, as set out in the privacy policy and terms. We never sell, rent or share it.
Responsible disclosure
Found a vulnerability?
Please tell us before you tell anyone else. We read every report.
Email support@profitiq.tech with what you found and how to reproduce it. Please give us reasonable time to fix it, do not access data that is not yours, and do not disrupt the service while testing. Our contact details are also published in security.txt.
FAQ
Security questions
Is my data safe?
Credentials for your stores and ad accounts are encrypted with AES-256-GCM before they are stored, all traffic uses HTTPS, and every business’s data is isolated from every other’s by row-level security in the database. See how ProfitIQ protects your data.
Who can see my business data?
Only the people you invite. The owner chooses a role for each teammate and switches individual sections on or off, and sensitive areas such as Settings and Team are owner-only.
Can I delete my data?
Yes. The owner can erase orders, products, marketing data, customers, suppliers or everything from Settings, immediately and permanently. See data deletion and the privacy policy.
Do you sell or share my data?
No. Your store, customer and ad data is used only to provide your analytics. It is never sold, rented or shared with third parties for marketing.
Connect a store with confidence.
Read-only connections, encrypted credentials, and a free plan to try them on.