How we keep your data safe
Where your orders and customer details are stored, who can see them, and what we never do with them.
Meets Shopify's Protected Customer Data requirements- Data stored only in the EU
Where an order's data goes
Every order passes through three places, and every connection between them is encrypted.
Your store
Shopify or WooCommerce
Your customer pays here. Card details stay with Shopify or WooCommerce, and we never see them.
OrderKrab
Hetzner servers in Germany
Customer details, store access tokens and carrier logins are stored encrypted with AES-256.
The carrier
DPD, Omniva, LP Express, DHL Express and others
Gets only what delivery needs: the recipient's name, address, phone and email.
You and your team reach OrderKrab over HTTPS too.
In more detail
Stored in the EU
Everything OrderKrab stores is kept on Hetzner servers in Germany, backups included. Nothing we hold is kept outside the EU, which keeps GDPR compliance simple.
Encrypted on the way and at rest
Every connection between you, OrderKrab, your Shopify or WooCommerce store and the carriers runs over TLS (HTTPS). Customer details, store access tokens and carrier logins are encrypted with AES-256 where they are stored, and so are the backups.
Sign-in and who sees what
Sign-in runs on Auth0, one of the most widely used identity providers. We never store passwords: logins, sessions and brute-force protection all happen on Auth0's side. Everyone on your team has their own login and role. A packer works with orders and shipments, while only an admin can connect stores, invite people or manage billing. You decide who gets access to what.
Only what delivery needs
Of your customer's personal details, a carrier gets only their name, address, phone number and email: what it takes to deliver the parcel. We never see or store payment card details, which stay with Shopify or WooCommerce. As an app on the Shopify App Store, OrderKrab meets Shopify's Protected Customer Data requirements.
Paying for OrderKrab
Your subscription is paid through Stripe. You enter your card details with Stripe, and we never keep the full card number on our systems.
Backups and deletion
Backups run automatically every day, and they are encrypted. If you stop working with us, tell us and we will delete all of your data.
Your data is used for one thing: your orders.
We don't sell your data or your customers' data, we don't pass it to anyone for their own use, and we don't use it for anything other than processing your orders.
Have a question about security?
The full details are in our privacy policy. If something isn't covered there, just ask.