Encrypted store keys
Every API key, password and token a merchant gives us is encrypted with AES-256 before it is stored. The API never returns it.
Security
Zikkio holds API keys to your customers’ stores and a copy of their catalogs. This page lists what we store, where it lives, how it is protected and how to reach us about a vulnerability.
Last updated 27 October 2026
At a glance
- Hosting
- AWS, United States (us-west-2)
- Store keys
- Encrypted with AES-256
- In transit
- TLS with certificate checks
- Data
- Catalogs, prices and orders
- Certifications
- No SOC 2 or ISO 27001 yet
- Contact
- security@zikkio.com
How store access is protected
Six rules that apply to every connection, on every plan.
One account, one tenant
Every request is checked against the account that owns the store. One customer can never read or change another customer’s connections.
TLS on every hop
Calls to Zikkio, and from Zikkio to the stores, use TLS with certificate checks. Store domains are validated before any call.
No card data
Zikkio reads products and orders and writes prices and stock. Card numbers never reach Zikkio: the platforms do not expose them.
Logs without secrets
Application logs are kept for five days. Store keys and request bodies never go into logs or alerts.
Limits per key
Rate limits per API key and per account keep one busy integration from slowing down the others.
What we store
Zikkio keeps a copy of each catalog so reads are fast and stores are not overloaded. This is everything we hold, and for how long.
| Data | What it is | How long we keep it |
|---|---|---|
| Store keys | What it is: API keys, passwords and OAuth tokens for each connected store, encrypted with AES-256. | How long we keep it: Deleted when the store disconnects |
| Catalog copy | What it is: Products and variants: name, price, cost, stock, brand, category, GTIN, SKU and image links. | How long we keep it: Deleted within 30 days of disconnecting, backups included |
| Account users | What it is: Name and email of the people who use the Zikkio account. | How long we keep it: While the account is open |
| Your API keys | What it is: The keys your application uses to call Zikkio, stored as hashes. | How long we keep it: Until you revoke them |
| Application logs | What it is: Errors and request metadata, without store keys or request bodies. | How long we keep it: 5 days |
| Job records | What it is: Status of catalog downloads and price updates. | How long we keep it: 30 days |
Card and payment details never reach Zikkio.
Sub-processors
The companies that process data on our behalf. We tell customers 30 days before adding a new one.
| Provider | What they do for us | Location |
|---|---|---|
| Amazon Web Services | What they do for us: Servers, database and cache for the API and the catalog copy. | Location: United States |
| Sentry | What they do for us: Error tracking, configured not to receive personal data. | Location: United States |
| Slack | What they do for us: Internal error alerts for the team, without store keys or request bodies. | Location: United States |
Shopify, WooCommerce, Magento, PrestaShop, BigCommerce, Wix and Google are the merchant’s own platforms, not sub-processors.
Security questions
Certifications, hosting, contracts and what happens to data when a store leaves.
Do you have SOC 2 or ISO 27001?
Not yet. When an audit starts we will publish its scope and date on this page. Until then we answer security questionnaires on request.
Where is the data hosted?
On AWS in the United States (us-west-2).
Is there a data processing agreement?
Yes. Every paid plan comes with our standard DPA. Ask for it at security@zikkio.com.
What happens to data when a store disconnects?
Its keys are deleted at once and the catalog copy within 30 days, backups included. Nothing stays behind for a store that left.
How do I report a vulnerability?
Write to security@zikkio.com with the steps to reproduce. We reply within two business days and will not take legal action against research done in good faith.
Do you store orders or customer data?
Orders are read from the store when your application asks for them, and they carry the end customer’s details. [How long order data is kept: to confirm.] Card details never reach Zikkio. The personal data we hold for ourselves is the name and email of the people on your account.
Connect your first store today.
Free plan with 5,000 API calls a month and unlimited stores. No card, and no sales call unless you ask for one.
POST
/v1/connect/sessions
curl -X POST https://api.zikkio.com/v1/connect/sessions \ -H "Authorization: Bearer zk_test_••••" \ -d '{ "platform": "shopify" }'
201 Created
{ "connect_url": "https://connect.zikkio.com/s/ses_3kd9" }