> For the complete documentation index, see [llms.txt](https://docs.peakcommerce.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.peakcommerce.com/product/using-peakcommerce/authentication-and-security/security-and-data-protection.md). # Security and Data Protection This page summarizes how PeakCommerce protects your data and the systems you connect to it, and what your team controls. Each section links to the page where you set it up. ## Data in transit * **Your team and your customers reach PeakCommerce over HTTPS.** * **Our connection to the database is encrypted.** Every deployed PeakCommerce environment requires an encrypted connection to its database. * **Webhooks only go to HTTPS endpoints.** When you add or edit a webhook subscription — in **Settings → Webhooks** or through the API — the URL must use `https://`. Loopback and private network addresses are refused, with the reason shown. ## Proving a message came from PeakCommerce Every webhook delivery is signed with a secret that PeakCommerce generates for that subscription. Your endpoint verifies the signature before trusting the payload, and you can rotate the secret at any time: the old and new secrets both sign deliveries for 24 hours, so you can deploy the new one without dropping anything. See [Webhooks](/product/settings/developer-tools/webhooks.md). Events PeakCommerce receives work the same way in reverse: for example, every event from Stripe is verified against your integration's own signing secret before it changes anything. See [Stripe subscription sync](https://gitlab.com/peakcommerce/peak-help-docs/-/tree/main/integrations/stripe/stripe-subscription-sync.md). ## Credentials and keys * **Each API key is limited to its scope**, and revoking a key takes effect immediately. Use one key per integration so you can revoke one without disrupting the others. See [API Keys](/product/settings/developer-tools/api-keys.md). * **Webhook signing secrets are generated for you**, never typed in, and are shown only when you create a subscription or choose **Reveal signing secret**. * **Credentials are masked in API call records.** Fields that carry secrets, tokens or keys are masked in the API call records PeakCommerce keeps. ## Who can see and do what * **Sign-in** runs through your identity provider or PeakCommerce's hosted login (Auth0), with the password policy and session rules you set. See [Single Sign-On for PeakCommerce Sites](/product/using-peakcommerce/authentication-and-security/single-sign-on-for-peakcommerce-sites.md), [Password Policies](/product/using-peakcommerce/authentication-and-security/understanding-and-configuring-password-policies-in-peakcommerce.md) and [Session Management](/product/using-peakcommerce/authentication-and-security/session-management.md). * **Profiles and permissions** decide what each user can see and change. See [Profiles & Permissions](/product/using-peakcommerce/profiles-and-permissions/user-profile-overview.md). * **Changes are recorded.** The audit log shows who changed what, and when. See [Viewing Audit Logs](/product/using-peakcommerce/authentication-and-security/viewing-audit-logs.md). ## Limits that protect your tenant Rate and concurrency limits stop a runaway script or a burst of traffic from crowding out your customers' checkouts. You can see how close you are to them on [API Usage](/product/settings/observability/api-usage.md). Limits for API keys are described in [Rate limits](https://gitlab.com/peakcommerce/peak-help-docs/-/tree/main/developers/api-reference/rate-limits.md). ## Questions from your security team For a security questionnaire or anything not covered here, contact your PeakCommerce account team. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.peakcommerce.com/product/using-peakcommerce/authentication-and-security/security-and-data-protection.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.