Platform
How Stoily runs your store
How a request reaches your store, what is yours alone and what is shared, and how your data is kept.
Serving
The path a request takes
A request reaches your store's hostname and passes our edge. Catalog and page data are cached in front of Magento; what the cache cannot answer reaches Magento, which reads your store's own database.
Tenancy
Yours alone, and shared
Each store has its own database with its own database user, its own file-storage prefix, and its own cache, search-index and message-queue namespaces. The servers that run Magento are shared, and pick a store's database on each request from a header our edge sets and strips from incoming traffic.
| Part | Yours alone or shared |
|---|---|
| Database and database user | Yours alone |
| File-storage prefix | Yours alone |
| Cache namespace | Yours alone |
| Search-index namespace | Yours alone |
| Message-queue namespace | Yours alone |
| Hostnames and domains | Yours alone |
| The servers that run Magento | Shared |
| The edge | Shared |
Scroll
Data
Your data
- Backups
- Your store's database is backed up every day, the changes in between are archived through the day, and a sample of store backups is test-restored every day. You restore from your admin.
- Encryption at rest
- Store databases, backups and uploaded files are encrypted at rest with AWS-managed keys.
- HTTPS
- Every store hostname and every domain you connect gets a certificate from Let's Encrypt, issued and renewed automatically.
- Where it runs
- Stoily runs on AWS in us-east-1, and your store's data and backups are kept there.
- Your content
- Your content stays yours. Export products and customers by CSV from the admin, or read your catalog, orders and customers through the REST API.
- Who changes your store
- Invite staff with their own sign-in and role, and see who changed what in the audit log.
Operations
Payments and monitoring
- Card payments
- Card details are entered into Stripe's payment fields and processed on your own Stripe account. Stoily does not store card numbers.
- How we watch it
- We run automated checks against the full serving path, from outside the cluster, continuously.
Disclosure
Report a vulnerability
Report a security vulnerability to contact@stoily.com, with enough detail to reproduce it.
Questions from a security review?
Write to us with the questions your review needs answered.