Shopbook
Sign inStart free
Start free
Security

What we can show, and what we cannot yet.

The guarantees are held by the database, not by a setting. The certifications are listed with their state, including the ones we do not have.

Request the security summaryor write to support@shopbook.io. A person replies.

01The record

History is never edited.

A change is a new entry; nothing is rewritten. A correction sits beside the entry it corrects, so what was quoted, approved and charged stays readable.

Amounts are whole cents, each line rounded and the sum exact. An issued invoice never changes; a void is its own record.

02The shop boundary

One shop's data stays its own.

Every table that holds a shop's data carries the shop's id, and the database refuses a read or write of another shop's rows.

Shopbook's operations console signs staff in with passkeys and cannot read a shop's customers, vehicles, repair orders, invoices, payments or messages: the database refuses it. Every staff action is written to an audit log no one can edit.

Main Street AutoIts own repair orders, customers and invoicesRO4156RO4582RO4602RO4600RO4607RO4149RO4583Another shopRows that carry another shop’s idROROROROROROROROROROShop boundaryheld in the databaseevery table that holds a shop’s dataRefuseda read across shopsstops at the databaseJordan Pike · advisorreads RO 4156 in his own shopShopbook operations staffsign in with a passkey; refused at both shopsCustomers, vehicles, repair orders,invoices, payments and messagesout of reach for staff; the database refuses it
The shop boundary, as the database holds it. Main Street Auto reads its own repair orders; another shop and Shopbook staff are refused.
03Sign-in and access

Sign-in is guarded, and changes are on record.

Passkeys, or email and password with a second step. After five failed sign-ins, each further try waits longer, from 30 seconds up to 15 minutes, per account and per network.

Settings changes and writes to audited records leave an audit event with who, when and what changed; the owner's export includes them.

Every AI action goes through one metered path and is capped before it runs. AI drafts; a person approves anything with a price or a promise.

Settings › Audit log at Main Street Auto. Each change shows who made it, when, and what it was before and after.
04Payments

Card numbers never reach us.

Cards are handled by Stripe; a card number is entered on Stripe's page and never reaches Shopbook. Invoices and payments are integer cents, reconciled to the cent.

05Backups and export

Your data leaves with you.

An owner exports the shop's records (repair orders, customers, invoices and their history) any time, in a form another system reads.

The database and its backups are held by Neon, in the United States. No restore rehearsal is recorded yet.

06Certifications

Certifications, listed as they are.

Including the ones we do not have.

SOC 2 Type IINot yet. No audit has begun. Every change is reviewed against SOC 2’s control areas: access checks on every action, audit records for security events, no secrets or customer contact details in logs, reviewed database changes, a health check for every outside service. That is how we build; it is not a certification.Not yet
PCICard payments run on Stripe; a card number is entered on Stripe's page and never reaches Shopbook.Via Stripe
Data processing termsThe Terms of Service's data-processing section and the Privacy Policy's subprocessor list are the standard terms.In the Terms
SubprocessorsThe table below. The list is updated on the Privacy Policy before a new provider receives shop data.Current
Data locationUnited States. Residency elsewhere is not offered. One exception: the breached-password check answers from Australia and receives only the first five characters of a password’s hash.Stated
Status pageShopbook’s own checks every five minutes, and incidents posted by Shopbook staff. 90 days of history. System status →Live
07Subprocessors

Who else handles a shop’s data.

One list, shared with the Privacy Policy, so the two never disagree. It is updated there before a new provider receives shop data. Privacy Policy

ProviderWhat it receivesWhereWhen
Vercel, Inc.Every request to the app while serving it; a shop’s own domain name when it adds one; AI feature requests, routed through the Vercel AI Gateway to the AI providers with no retentionUnited StatesAlways
Neon, Inc.The shop’s data, stored in the database and its backupsUnited StatesAlways
Vercel BlobFiles and photos a shop uploads, and the exports it downloadsUnited StatesAlways
Functional Software, Inc. (Sentry)Error reports with customer data removed: the error type and stack trace, the page’s route pattern (never its address), the release, the runtime and browser family, an opaque shop id, the shop’s short name (its slug) and the signed-in member’s role; never request bodies, headers, cookies, addresses, names, emails, phone numbers, plates, VINs, links with tokens or promptsUnited StatesAlways
Stripe, Inc.The amount and the invoice or deposit it is for, for each card payment; the shop’s own billing details for its subscriptionUnited StatesAlways
Anthropic, PBCThe request and the shop records it cites, and any attached images, when someone uses an AI featureUnited StatesAlways
Microsoft CorporationThe audio of an inspection voice note, to transcribe it, with zero data retention; for someone who signs in with Microsoft, the sign-in request (Microsoft returns their name and email address)United StatesAlways
Resend, Inc.The recipient’s address, the subject and the body of each email Shopbook sendsUnited StatesAlways
Twilio Inc.The recipient’s phone number and the message, for a shop with text messaging configuredUnited StatesWhen connected
Google LLCThe sign-in identity, appointment details written as calendar events, and contact names, emails and phone numbers read on a contacts import; at setup, the shop name and town an owner types to find the shop’s Google profileUnited StatesWhen connected
Intuit Inc.Paid invoices (lines, tax, customer name and email) and their payments, for QuickBooksUnited StatesWhen connected
PartsTech, Inc.The vehicle’s VIN, or its year, make and model, when a shop opens a parts searchUnited StatesWhen connected
Have I Been Pwned (Superfly Pty Ltd)When a password is set or changed: the first five characters of its hash, and nothing else; the match happens on Shopbook’s serversAustraliaAlways
U.S. National Highway Traffic Safety Administration (vPIC)A vehicle’s VIN, or its year, make and model, to decode it and look up open recallsUnited StatesAlways

Questions a security review will ask? Ask them.

Start freeRequest a demo