Security

Security: how we protect your store

What we run for every store, and the certifications we do not hold.

Controls

Isolation: Every store runs on its own database, its own storage prefix and its own domain. Shoppers reach a store at its own hostname, never at a shared address with an account ID in the URL.
Encryption: Every store and every domain you connect gets HTTPS, with certificates issued and renewed for you. Backups and file storage are encrypted at rest.
Backups: Your store is backed up every day. Restore it to an earlier point in time from your admin, within the backup window.
Patching: We apply security patches and Magento upgrades for you. You do not install or schedule them yourself.
Extensions: Uploaded extensions are scanned before they are built into your store. An admin app runs in a sandbox and stays off until the store owner turns it on.
Infrastructure: Stoily runs on AWS in us-east-1. You do not operate a server, and there is no server for you to log into.

Stoily is not SOC 2 or ISO 27001 certified. We run on AWS, which holds both, and that is Amazon's attestation rather than ours.

We publish no availability percentage, and our terms carry no service credits. This page describes how the platform is built instead.

Need answers for a security review? Write to us, and a person who works on the platform will reply.

Create an account, choose a plan and build your storefront in PageBuilder.