Security

Sign-in runs through WorkOS, a dedicated sign-in provider, so StoreGist never stores your password.

Once you are signed in, your session is kept in a secure cookie that only the dashboard can read and that scripts on the page cannot reach. Signing out ends the session on our side as well as in your browser.

Every business’s information is kept separate. The separation is enforced by the database itself, not only by the dashboard, so one business can never see another business’s stores, team, or records.

Each teammate signs in with their own account and has one role. Every request is checked against that role before anything is shown or changed.

• Only owners and administrators can invite or remove people.
• An account always keeps at least one owner.
• Ownership moves only through a deliberate transfer, never as a side effect of another change.

See what each role can do on the manage page.

• Every page is served over a secure, encrypted connection.
• Changes to your account carry a check that confirms they came from you, which blocks forged requests from other sites.
• Important changes are recognised if they are sent twice, so a double click does not create two of something.
• Important account changes are recorded with who made them and when.

Payments are not open yet. When they open, they will run through Bachs, our payment partner, which will handle card and bank details so that StoreGist does not store them.

StoreGist does not hold independent security certifications yet. Enterprise customers can ask us for more detail about how we protect their information.

If you believe you have found a security problem, please tell us before sharing it publicly. Our contact address is being set up and will appear here as soon as it is ready. If you already have an account, you can sign in to your dashboard.