Security

• HTTPS — Traffic between your browser or app and our APIs is encrypted in transit (TLS). • Authentication — Passwords are stored using industry-standard hashing; we do not store plain-text passwords. • Sessions — Access tokens are required for authenticated API calls; unauthenticated public endpoints are limited to signup, marketing forms, and documented webhooks. • Authorization — Role-based permissions control what each user can view or change within a tenant. • Tenant isolation — Business data is scoped to your organization; cross-tenant access is blocked at the application layer.

Our services run on managed cloud infrastructure with network firewalls, patched operating environments, and monitored uptime. Database access is restricted to application services and operational staff with a need to know.

Card and mobile-money payments are handled by certified payment partners. Shopynn does not store full payment card numbers on our application servers. We retain transaction references and status for billing support.

• Least-privilege access for employees and contractors. • Separate production and non-production environments where practical. • Logging and monitoring for authentication failures and abnormal API patterns. • Backups to support recovery from hardware or software failures.

Security is shared. We recommend: • Using strong, unique passwords and enabling password changes after temporary credentials are emailed. • Limiting Super Admin access to trusted owners. • Reviewing user roles and deactivating staff who leave your business. • Keeping devices and browsers updated. • Reporting suspected incidents promptly to hello@shopynn.app

If we become aware of a security incident affecting your data, we will investigate, mitigate, and notify affected customers as required by applicable law and contract.

We welcome responsible disclosure of security issues. Email hello@shopynn.app with details and allow reasonable time to remediate before public disclosure.