Two-step sign-in
Code from the authenticator app
482913
Verified, Ruth K. signed in
Security
Your store, protected
Two-step sign-in for every account, staff who reach only what their role needs, a record of every change in the admin, and card numbers that stay with the payment provider. Your vendor review starts with one link.
Role: PackingWhat Owen P. can reach
- OrdersFulfil
- ProductsView
- PaymentsViewNo access
- StaffNo access
Activity log
Ruth K.Locked Payments for Packing
Four layers of protection
SecurityUsersProductsOrders Export
- Ruth K.Edited Packing role
- Owen P.Fulfilled KF-2318
Every admin change on record
Each change is saved with who made it, what it touched and when. Filter the log by area, such as security or orders, and export it.
Stripe payment field
4417 •••• •••• 9113
Saved on the order Token, card 9113
Card numbers stay with the provider
Buyers type card details into the provider's own field. Stripe or Braintree turns them into a token, and your store keeps only that token.
- Sign-in attemptsRate limited
- Traffic floodMitigated
- File uploadScanned
TLS 1.2+ in transit AES-256 at rest
Attacks stopped at the edge
Every request meets Cloudflare first: its firewall, API Shield and DDoS mitigation, then our API rate limits. Uploaded files are scanned for malware.
- TriageWithin 15 minutes
- ContainWithin an hour
- Tell merchantsBy law and contract
Watched, with a plan for incidents
Errors and slowdowns are tracked as they happen and posted on a public status page. Our incident response plan sets the targets for a critical incident.
1 of 4
Security questions
Assistant in your admin
Archive the 3 sold-out knives
Needs your confirmation
ConfirmCancel
Sign-in: OAuth Store data training: Off
Does my store keep card numbers?
No. Buyers type card details into the payment provider's own fields, and Stripe or Braintree tokenizes them. Tanqory stores customer IDs and tokens, not card numbers.
How are passwords and sign-in codes protected?
Passwords are stored as Argon2 hashes, and two-step backup codes are hashed too. The secret behind your authenticator-app codes is encrypted with AES-256-GCM before it is stored.
Do you train AI models on my store data?
No. Tanqory trains no models of its own. AI features call third-party models, and with OpenAI and Anthropic, training on what we send is switched off.
How do AI assistants reach my store?
Through the Tanqory MCP server, after you sign in with OAuth. The assistant in your admin acts on products, orders and settings only with your confirmation.
Assistant in your admin
Archive the 3 sold-out knives
Needs your confirmation
ConfirmCancel
Sign-in: OAuth Store data training: Off
Your security review, answered with one link
Send your reviewer the trust center instead of a week of questionnaires. Each answer here is a page there, with its status as it stands today.
Vendor security review4 answers
Card payments In progress
PCI DSS scope SAQ-A: Stripe, a PCI DSS Level 1 service provider, handles the card. Our self-assessment is in progress. Compliance
Privacy In place
For your buyers' data you are the controller and Tanqory the processor, under our Data Processing Agreement. Privacy
Audit reports Not yet
No SOC 2 or ISO/IEC 27001 audit has started, so none is passed and none is claimed. Compliance
Transparency Not yet
No transparency report is published yet. Every government request for data is logged and kept two years. Transparency
Each status as the trust center states it