Trust at GorZesk

Where data is stored

The database and files are stored by Supabase in Singapore.

Data processing terms: version 1.0. Data processing terms

AI and your data

• Using a store's data to improve AI models is switched off by default.
• Only the store's Owner can switch it on, after a fresh sign-in, and every change is recorded in the store's audit log.
• Conversation text is sent to an AI provider only to write a reply.
• A guard checks each AI call against the provider's terms. Today it records a would-be block and does not stop the call yet.
• No AI provider's data terms are confirmed in writing yet.

Service providers

The companies that process store data for GorZesk. Changes are announced 14 days ahead.

Encryption

• The website and web app are served over HTTPS (TLS) by Vercel.Run by our providers
• The GorZesk API is served over HTTPS (TLS) by Render.Run by our providers
• Supabase, which keeps the database and files, encrypts stored data at rest (Supabase's own statement).Run by our providers
• Tokens for connected channels, stores and apps are encrypted by GorZesk (Fernet) before they are stored. The key is kept outside the database.Run by GorZesk
• Outside local development, GorZesk refuses to store a new token while the encryption key is missing.Run by GorZesk
• API keys and connection codes are stored only as SHA-256 hashes. The full key is shown once.Run by GorZesk
• Card numbers typed into messages are masked before they are stored.Run by GorZesk
• Files people upload are checked before anyone can open them.Run by GorZesk

Backups

• Database backups run every day.
• Point-in-time recovery is not switched on.
• No restore test is recorded yet.
• No recovery-time or recovery-point figure is published, because none has been measured.

Status

Live state of the GorZesk API, background worker and web app, with published incidents and planned maintenance. Open the status page

Controls in the product

• Roles and permissions for every teammate
• Two-step verification that a store can require
• Session limits and signing out other devices
• Network allow lists for the app and the API
• An audit log of settings and data changes
• Card numbers masked before storage
• Redaction rules for sensitive text
• Retention rules that delete old data
• Privacy requests: export and erasure
• Encrypted tokens for connected apps
• Checks on uploaded files
• A public status page

Report a security problem

Email security@pinevon.com. How reports are handled is described on the security page. security@pinevon.com

How GorZesk protects datasecurity.txt

Not yet

Things GorZesk does not have yet. They are listed so nobody has to guess.

• A SOC 2 report
• An ISO 27001 certificate
• An independent penetration test
• An uptime commitment
• Recovery-time or recovery-point targets
• Point-in-time database recovery