Security

sochra.com is our marketing website, with a public demo and an early-access form. It has no accounts or sign-in, and it doesn't connect to your store.

What the site holds

• Early-access requests you send through the form, in a private database that only our team can read. They're deleted 6 months after you send them.
• Scrambled (hashed) IP counts that protect the form from abuse, kept up to 2 days.
• The public demo uses example data only. It holds no real store, customer or order data.

How data is protected

• Encrypted in transit (TLS 1.2+) and at rest.
• Hosted on Cloudflare, with DDoS protection and a web application firewall.
• The alert our team gets for each request holds only a reference number, not your details.
• Staff access is limited to the people who need it.

How we work

• Separate test and live sites; real requests are never used for testing.
• Code review and automated checks on every change; dependencies and build steps are pinned.

Incidents

If a breach affects your data, we tell you without undue delay.

Report a vulnerability

Email security@sochra.com. Include the affected URL, steps to reproduce and impact. Please give us reasonable time to fix before disclosure; we won't take action against good-faith research that respects other people's privacy. A /.well-known/security.txt file points to the same address.

We don't hold any security certifications yet.