Security

Last updated: 12 October 2026

The short version. An agreement receipt is only useful if it is trustworthy, so Consently is built to protect it: every store's data is isolated from every other store's, no card data is ever handled, everything travels and rests encrypted, and the app never edits a receipt's wording after it is written. A session only exists after we have verified the caller actually owns the store.

Per-store isolation

Every record Consently stores (configuration and agreement receipts) is scoped to the single store it belongs to, and every query is bound to that store. One store's data is never visible to another, even when the same person owns and has installed the app on more than one store. Isolation is keyed to the store, not the owner.

A verified ownership check before any session

When the app loads inside the OpoShop admin, Consently proves ownership using the caller's own credential against OpoShop before it will mint a session. It never trusts a claim it cannot verify with a token the caller actually supplied. No authenticated session exists until that check passes, which is what stops one merchant from reaching another's records.

Receipts are never edited by the app

The exact agreement wording on a receipt is copied by our server from the merchant's saved settings at the moment of acceptance. It is never taken from the shopper's browser, so a shopper cannot change what they agreed to. Once written, a receipt's wording, time and shopper details are never updated by the app, and the app has no screen or endpoint that edits or deletes one. The only thing added later is the order it belongs to, and only after we have confirmed that order with OpoShop.

To be exact about the limit: a receipt is a row in our database. It is not signed or sealed cryptographically, so its trustworthiness rests on our access controls and on the fact that nothing in the app can change it, not on a mathematical proof.

No card data, ever

Consently takes no payments and never sees a card number, bank detail or billing address. Linking a receipt to an order uses only the order's identifier, never its payment information, so there is no cardholder data in the system to protect or to leak.

Encryption

All traffic, between a shopper's browser, the admin app and our API, runs over HTTPS/TLS. Data at rest lives in MongoDB Atlas, which encrypts stored data by default. The app's own secrets are held as encrypted platform secrets, never in source control. Each store's OpoShop access token is kept in that database.

Least privilege

The app asks OpoShop only for what it needs: to verify ownership, read the store name and owner email for branding and contact, and read an order so a receipt can be tied to it. It requests no ability to write to your store, and it cannot create, change or delete a product, an order or a customer.

Built to fail safe

On the storefront, Consently is designed to fail invisibly: if it cannot load its configuration or hits any error, it shows nothing and blocks nothing, so your store keeps working normally. A security or availability problem in the app can never trap a shopper or break your checkout.

Hosting & subprocessors

Fly.io: application hosting.
MongoDB Atlas: the encrypted database (United States).
OpoShop: the platform the app runs on and the source of order events.
PostHog: product analytics for the merchant-facing admin only, never about a shopper's acceptance.

Reporting a vulnerability

If you believe you have found a security issue in Consently, please email brandon@tryfound.io with the details. We take reports seriously, will acknowledge yours, and ask that you give us a reasonable chance to fix an issue before disclosing it publicly.

Contact

Found · brandon@tryfound.io