Security and data

Read-only by construction

velur holds read scopes on Shopify and a restricted read key on Stripe. There is no write scope in the Shopify app manifest, and a Stripe secret key is refused before Stripe is ever asked about it. velur stores no card numbers, so a velur breach cannot move money.

Customers are pseudonymous

A customer becomes a one-way 16-character reference at the boundary between the rows velur fetches and everything computed from them. The reference is stable, so "the same customer" is answerable across sources and across months, and it cannot be turned back into a person.

Only aggregates reach the model

The model sees aggregated figures, their deltas, versions, units and dates, the flags that fired, the freshness of each sync, open corrections and your currency. It never sees a customer name, an email address, an individual order, a charge, a refund, a line item or a free-text field from a source system. That list is asserted in code on every run, not left to convention.

Isolation and storage

Every row carries the workspace it belongs to, and the isolation is enforced at the database layer, not in the application. Your data is invisible to every other workspace.

Data is stored in the EU. The sub-processors are Supabase for the database, in the EU, Vercel for hosting, Anthropic for the brief's sentences when narration is enabled, and Resend for email delivery.

Deletion

Disconnecting a source deletes the token velur stored for it. On Shopify, a redaction request from the store deletes that workspace's data and destroys its grant, and a customer redaction removes that customer's pseudonym and recomputes what was built from it. Both are automatic and both leave a record of when they were handled.

What velur does not claim

velur holds no SOC 2 or ISO certification today and will not imply otherwise. A data processing agreement is signed with every brand before their data flows. If you need something not answered here, write to hello@velur.io.