Security
Keep control of your website and business data
Your customers should be able to keep using your website, and your private business records should stay private. Here is how Rebilder protects credentials, separates merchant data and handles payments.
Available to customersProducts · services · policies
Kept behind the scenesPrivate settings · credentials
Your credentials
- Site API keys are stored as SHA-256 hashes only. The raw key is shown exactly once at creation; we cannot recover it, only replace it.
- Platform OAuth tokens (the managed Shopify app) are encrypted at rest with AES-256-GCM. The plaintext column does not exist.
- Webhook and internal-API signatures are verified over raw bytes with constant-time comparison before anything is parsed.
Payments
- Card data never touches Rebilder servers. Checkout and the billing portal are Stripe-hosted pages; we store identifiers and subscription state only, for a zero-PCI surface.
Data isolation
- Merchant data lives in a dedicated database schema behind a dedicated service role, with row-level security enabled and policies that deny any role we have not granted. Public API layers never see these schemas.
- The data wall is structural: per-site data never feeds any negotiation engine, and only k-anonymized aggregates (minimum 25 independent sites per bucket, enforced in the database views) ever cross it. A CI check fails any build that violates the boundary.
- Agent-intent capture is PII-screened at the edge, fail-closed: a query that might identify a person is dropped before storage, not scrubbed after.
Your site’s independence
- The serving path runs in your infrastructure. A failure in our code is a no-match that falls through to your normal HTML, and no Rebilder outage can affect what your site serves.
- The CLI and MCP server send no telemetry: no scan, URL, hostname, or result is ever uploaded. This is a stated contract, not a default you have to find and switch off.
Responsible disclosure
Found a vulnerability? Email security@rebilder.com and a human reads it. We commit to acknowledging reports within two business days, we will not pursue good-faith research, and we credit reporters who want credit.