Security

Keys

• Every store has a public key for the storefront, which can only search and record search events, and a secret key for syncing products and changing settings.
• The secret key never needs to be in the browser. The WordPress plugin and Shopify app keep it on the server.

In transit and at rest

• All traffic to the website, dashboard and API uses HTTPS.
• Passwords are stored as salted PBKDF2 hashes. Dashboard sessions use random tokens that are stored hashed.
• Services run under a dedicated, unprivileged system user.

Limits

Search and sign-in endpoints are rate limited to slow down abuse and password guessing.

Data we don't collect

Gazelle doesn't collect shoppers' names, email addresses, postal addresses or payment details. See the privacy policy for the full list.

Reporting a vulnerability

Email support@gazellesearch.com with the details. Please give us a reasonable time to fix the issue before disclosing it.