Encryption
All traffic to ecomGear uses HTTPS, and browsers are told to insist on it (HSTS). Secrets you store in a project, such as API keys, are encrypted with AES-256-GCM before they are saved.
Access control
Workspaces have roles. Sensitive actions, such as changing billing or domains or deleting a project, need the right role and a recent sign-in, and are written to an audit log.
Your project data
Each project has its own database, with limits on how much one project can use, so a busy project cannot slow the platform down for everyone else.
Abuse protection
Sign-in is protected against automated abuse (Cloudflare Turnstile), and rate limits apply to sign-up, name searches and similar actions.
Changes and backups
We take a backup of the platform database before each release that changes it.
Report a security issue
If you think you have found one, email info@ecomgear.dev with "Security" in the subject. Please give us reasonable time to fix it before sharing it publicly, and do not access other people's data while testing.