Security

Anookz holds a shop’s sales, stock and supplier relationships, takes card payments, and connects to the systems a business runs on. This page sets out how that is protected, and what has not been independently verified. It complements our Data Processing Addendum.

Data protection

• TLS on every connection, and database storage encrypted at rest.
• Integration credentials are additionally sealed with AES-256-GCM before being written, so a database dump does not yield a usable credential.
• Access tokens are held server-side only and are never returned to a browser.
• Card details are handled by Stripe. Anookz never sees or stores a full card number.

Access control

• Every account’s data is scoped to that account, and within it to the store or site it belongs to. Scoping is enforced on the server, on every request, not in the interface.
• Roles, permissions and scopes control what each team member can reach.
• Sensitive operations require re-authentication, and their outcomes are recorded.
• Administrative access is limited to an allowlist, and administrative actions are recorded in an audit log.
• Sign-ins, failed attempts and active devices are visible to you in your own account.

Authentication

• Sign-in is handled by a dedicated identity provider, with passkeys supported.
• Passwords are hashed with scrypt and checked against known-breached password corpora.
• Repeated failed attempts lock an account rather than allowing indefinite guessing.

Platform and operations

• Hosted on managed cloud infrastructure with a web application firewall, bot protection and rate limiting in front of the application.
• Development runs without production data; production credentials are held separately.
• Errors and performance are monitored continuously, and background jobs record their own runs so a silent failure surfaces as a missing run rather than as nothing at all.
• A daily canary compares row counts on append-only tables and raises a critical alert on unexplained shrinkage — the check that catches data loss before a customer reports it.

Incidents

We notify affected merchants without undue delay after becoming aware of a personal data breach, with what is known, what is affected and what is being done — including where information is still incomplete. Where a breach has caused or is likely to cause serious harm, we also notify the Office of the Privacy Commissioner as required by the Privacy Act 2020.

What has not been certified

Anookz holds no third-party security certification — no SOC 2, no ISO 27001 — as at the date above, and has not had an independent penetration test published. We state this plainly rather than omit it, because you are entitled to know what has and has not been independently verified. The controls described on this page are real and checkable; they have been verified by us, not by an auditor.

Reporting a vulnerability

Email security@anookz.com with enough detail to reproduce the issue. We will acknowledge within two business days. Please give us a reasonable opportunity to fix it before disclosing publicly, and do not access, modify or retain data belonging to anyone else while testing. We will not pursue legal action over good-faith research that follows this.

Security questionnaires

If you need this in a specific form for procurement, email security@anookz.com.