MCPify for WooCommerce

Security

Last updated 2026-11-02

This page describes how we protect the data MCPify for WooCommerce handles (technical and organisational measures under Art. 32 GDPR) and what we do if something goes wrong. It is part of our data processing agreement.

1. Connecting a store

  • A store is connected only by a WordPress administrator, through WooCommerce's own approval screen for REST API keys. The key can be read-only.
  • MCPify confirms each connection with the plugin on the same site before it keeps the key, so a store cannot be connected to someone else's account.
  • MCPify only sends requests to stores over HTTPS and never to private or internal network addresses.
  • Disconnecting the store or deactivating the plugin deletes MCPify's REST API key in the store and at MCPify.

2. Access control

  • Every AI client uses its own connection with permissions per store area (read, change, delete), set by the store owner.
  • Customer data is off by default; while it is off, names, addresses, email addresses, phone numbers and IP addresses are removed from responses. Price changes, refunds and permanent deletes are off by default as well.
  • Raw REST API requests beyond the curated tools must be granted one by one; a deny list blocks requests completely.
  • The MCPify dashboard opens only from the WordPress admin, with a signed sign-in link that works once and for 60 seconds. There are no separate passwords.
  • Requests are rate limited per connection.

3. Encryption

  • All connections use HTTPS (TLS).
  • The database and its backups are encrypted at rest by the hosting provider.
  • The store's REST API key and the secret shared with the plugin are additionally encrypted with AES-256-GCM.
  • API keys, OAuth tokens, authorization codes, pairing codes and dashboard sessions are stored only as SHA-256 hashes.

4. Hosting and backups

  • Hosting: Render Services, Inc. (region Frankfurt, EU). The service and its database run in the EU, separate from MCPify for Shopify.
  • The database can be restored to any point in time within the last 3 days.
  • A test store with invented sample data is used for development and testing; production data is not copied into test systems.

5. Logging and data minimisation

  • Every AI request, including blocked ones, is written to an audit log the store owner can review.
  • Customer names, email addresses, phone numbers and addresses are removed from request arguments before they are logged.
  • Audit log entries are deleted after the retention period of the plan; responses kept for safe retries after 24 hours.
  • All data of a store is deleted 30 days after it was disconnected, unless it is connected again.

6. Organisation

  • Only the operator has access to the hosting, database, code repository and domain accounts.
  • These accounts are protected with strong, unique passwords and two-factor authentication.
  • Code changes go through pull requests and are tested before they are merged and deployed, including an end-to-end test of connecting a store and automated security scans.

7. Security incidents

A security incident is any event that may have led to unauthorised access to, loss or disclosure of personal data. We then:

  1. Contain: stop the cause right away, for example by revoking keys and tokens, blocking connections or taking the service offline.
  2. Assess: work out which stores, data and people are affected, and how likely harm to them is.
  3. Notify: inform affected merchants without undue delay and within 48 hours of becoming aware, by email, with what happened, which data is affected, what we have done and what they should do. Where we are the controller (merchant account data), we notify the supervisory authority within 72 hours if required.
  4. Fix and document: remove the root cause, restore data from backups if needed, and record the incident, its effects and the measures taken.
  5. Review: check afterwards whether our measures need to change.

8. Reporting a vulnerability

Found a security issue? Email Legal@getmcpify.app. Please give us a reasonable time to fix it before disclosing it. We do not take legal action against good-faith reports.