Security

Security is central to how we build Delrity. We use a combination of technical and organisational measures to protect your account, your data, and the websites you publish. No system can be guaranteed completely secure, but we work continuously to reduce risk and to respond quickly when issues are reported.

The Delrity platform is served exclusively over HTTPS, and we provision SSL/TLS certificates for published sites on both Delrity subdomains and connected custom domains. This means connections between browsers and our services are encrypted in transit. We also send security headers, including HTTP Strict Transport Security and a Content Security Policy, to reduce the impact of common web attacks.

Accounts are protected with email-and-password authentication. Passwords are stored using one-way hashing and are never stored in plain text. Sessions use secure tokens, and we record session metadata (such as IP address and browser user-agent) to help detect and respond to suspicious activity. Sign-in, sign-up and password-reset requests are rate limited. Changing your password signs out your other sessions, and resetting it signs out all of them.

The platform is hosted on Vercel, and our data is stored in a managed PostgreSQL database provided by Supabase. We rely on these providers’ infrastructure security controls in addition to our own application-level measures. Our domains also use Cloudflare for DNS and to filter malicious traffic. You can see the providers we use on our Subprocessors page.

Sensitive credentials such as API keys and database connection strings are stored as environment variables in our hosting and provider platforms, and are kept out of our source code. Access to production secrets is limited to those who need it.

If you connect a payment provider to sell products with Commerce, your account credentials for that provider are encrypted at rest (AES-256-GCM) before they are stored, and are never sent back to a browser. Your customers’ card details are handled directly by your chosen payment provider and are never stored on our servers.

Our managed database provider performs regular automated backups of the database, which support recovery in the event of data loss. Backup capabilities depend on the provider’s service.

Access to customer and organisation data by Delrity staff is limited to what is needed to provide support, investigate abuse, or maintain security, and is kept separate from the access any customer has to their own account. Higher-risk actions require a recent sign-in, and administrative actions and access to sensitive data are recorded in an internal audit trail.

If you believe you have found a security vulnerability in Delrity, please report it to us privately at security@delrity.com rather than disclosing it publicly. Give us a reasonable opportunity to investigate and address the issue before any public disclosure. Please do not access or modify other users’ data while testing.

For details on how we collect and use personal information, see our Privacy Policy.