Privacy and data

Security: how Zyro protects your data

The short version of the security part of our privacy policy.

How it's protected

  • Where it runs: Amazon Web Services in the United States (US East).
  • In transit: everything between your browser and Zyro goes over HTTPS.
  • Passwords: stored as salted one-way hashes, never as text. You can also sign in with a passkey. Sign-in options
  • Keys for your tools: access tokens and API keys are encrypted at rest and never shown again.
  • Cards: handled by Stripe, or by Shopify when you pay through Shopify. Card details never reach Zyro.
  • Abuse: rate limits, bot filtering and sign-in lockouts.

How long it's kept, and erasing it

  • Store data stays until you delete it, a shopper's erase request removes it, or you leave.
  • Erase one shopper from their page with Erase this shopper. Shopify privacy requests are handled automatically. Data and privacy
  • Who helps run Zyro is on the sub-processors page.

No system is completely secure. If a breach is likely to cause serious harm, we tell the people affected and the Australian privacy regulator, and affected stores without undue delay. To report a security problem, email hello@zyro.world.

Related articles

Shopify permissionsWhat Zyro asks Shopify for, and why. Data and privacyWhat Zyro keeps and how to delete it. Sign-in and securityPasskeys, codes and signing out other devices.

Did this answer it?