Now onboarding our first 50 founding shops in France, Belgium and the UK
  1. Home
  2. Security
Security

Online shop security, in plain language.

Good online shop security starts with what we never handle: your customers' card details. Here's how payments, data and access work at Add Your Shop — and how to tell us if you spot a problem.

Data processing agreement Report a vulnerability
The short version

Six things worth knowing.

Card payments by Stripe

Card details are entered into Stripe's secure payment fields and processed by Stripe. They never touch our servers. Stripe is certified PCI DSS Level 1 — that certification is Stripe's, not ours.

HTTPS everywhere

Your shop and this website are only served over encrypted HTTPS connections.

Hosted on Cloudflare

Our shops and this website run on Cloudflare's network, which includes protection against denial-of-service attacks.

Only the data an order needs

Your shop asks customers for what it takes to prepare an order and keep them informed about it. Nothing more.

Clear GDPR roles

For your customers' order data, you're the controller and we're your processor. For our own contacts, we're the controller.

Access on your terms

Any access you give us is used only for the job you asked for, and you can remove it whenever you like.

A payment, step by step

Where card details go — and where they don't.

01

The customer checks out

Your shop passes the order total to Stripe over an encrypted connection. No card details are involved yet.

02

The customer enters a card

The card is typed into Stripe's payment fields, or comes from Apple Pay or Google Pay. It goes to Stripe, never to us.

03

The bank checks it's them

If the customer's bank asks for a code or an approval in its app, Stripe handles that step.

04

Stripe confirms the payment

We receive confirmation that the order is paid — never the full card number — and the order goes to your inbox.

Data minimisation

What your shop asks customers for. And why.

  • NameSo you know whose order it is at the counter or on the doorstep.
  • Contact detailsTo send the order confirmation and reach the customer about their order if needed.
  • Delivery addressOnly for local delivery and shipping orders.
  • The order itselfProducts, quantities, the amount paid, and the pickup slot or delivery date.
  • A gift messageOnly if the customer chooses to write one.
  • Payment confirmationWhether the payment succeeded, as confirmed by Stripe. Never the card number.

We process this data on your behalf, under our data processing agreement.

GDPR

Who's responsible for what.

Your customers' order data. You're the seller, so you're the controller. We process that data for you, on your instructions, as your processor. Our data processing agreement sets out our commitments.

Our own contacts. When you write to us or apply for a shop, we're the controller of your details. Our privacy policy explains what we collect and why.

Payments. Stripe processes payment data under its own terms and privacy policy, which you accept when you open your Stripe account.

Access you give us

Your keys stay on your keyring.

Your website

If you'd like us to add the Shop link, invite us as a separate user or collaborator rather than sharing your own password, and remove us once the link is in.

Your Stripe account

It's yours, in your name, and you hold the login. Your shop is connected to it so that payments reach you.

Only what the job needs

We use any access you give us for the task you asked for, nothing more, and tell you when we're done.

What we'll never ask for

Your card details or your online banking password. If someone claiming to be us asks, don't reply — forward the message to security@addyour.shop.

Responsible disclosure

Found a flaw? Tell us first.

If you think you've found a security vulnerability in Add Your Shop, in a shop we host or in this website, email security@addyour.shop. We aim to reply within one working day. Our contact details are also published in /.well-known/security.txt.

  • Describe the issue and how to reproduce it
  • Don't access, change or keep data that isn't yours
  • Don't disrupt shops or their customers
  • Give us reasonable time to fix it before going public
Email security@addyour.shop
Questions

About security

Do you store my customers' card numbers?

No. Card details go to Stripe and never touch our servers. We only receive confirmation that a payment succeeded.

Is Add Your Shop PCI certified?

We don't hold a PCI certification ourselves and don't claim one. Card data is handled by Stripe, which is certified PCI DSS Level 1 — the most stringent level in the payments industry.

Who is responsible for my customers' data?

You are: as the seller, you're the controller of your customers' order data. We process it for you, to run your shop, under our data processing agreement.

What happens if there's a data breach?

If a breach affected your customers' data, we would tell you without undue delay, as the GDPR requires of a processor, so that you can meet your own obligations.

Can I remove your access to my website?

Yes, at any time: delete or disable the user account you created for us. Your shop doesn't depend on it.

How do I report a security problem?

Email security@addyour.shop with a description and the steps to reproduce it. Please don't go further than you need to show the issue, especially where shops or their customers' data are involved.

Get started

Sell online without handling card data.

We set up your shop and help you connect your own Stripe account. Tell us about your business and we aim to reply within one working day.

Get your shop Talk to us