Security

Last updated: 6 August 2026

Per-store isolation

Every record Consently stores — configuration, daily counters and agreement receipts — is scoped to the single store it belongs to, and every query is bound to that store. One store's data is never visible to another, even when the same person owns and has installed the app on more than one store. Isolation is keyed to the store, not the owner.

A verified ownership check before any session

When the app loads inside the OpoShop admin, Consently proves ownership using the caller's own credential against OpoShop before it will mint a session — it never trusts a claim it cannot verify with a token the caller actually supplied. No authenticated session exists until that check passes, which is what stops one merchant from reaching another's records.

Receipts are immutable

The exact agreement wording on a receipt is snapshotted on our server at the moment of acceptance — never taken from whatever the shopper's browser claims — so it cannot be forged. Once written, a receipt's agreement fields are never updated; the order id is attached later from the OpoShop webhook, and nothing else changes. That immutability is what makes the record credible as evidence.

No card data, ever

Consently takes no payments and never sees a card number, bank detail or billing address. Linking a receipt to an order uses only the order's identifier — never its payment information — so there is no cardholder data in the system to protect or to leak.

Encryption

All traffic — between a shopper's browser, the admin app and our API — runs over HTTPS/TLS. Data at rest lives in MongoDB Atlas, which encrypts stored data by default. Secrets and access tokens are held as encrypted platform secrets, never in source control.

Least privilege

The app asks OpoShop only for what it needs: to verify ownership, read the store name and owner email for branding and contact, and receive order events to link receipts. It requests no ability to write to your store, and it cannot create, change or delete a product, an order or a customer.

Built to fail safe

On the storefront, Consently is designed to fail invisibly: if it cannot load its configuration or hits any error, it shows nothing and blocks nothing, so your store keeps working normally. A security or availability problem in the app can never trap a shopper or break your checkout.

Hosting & subprocessors

• Fly.io — application hosting.
• MongoDB Atlas — the encrypted database (United States).
• OpoShop — the platform the app runs on and the source of order events.
• PostHog — product analytics for the merchant-facing admin only, never about a shopper's acceptance.

Reporting a vulnerability

If you believe you have found a security issue in Consently, please email brandon@tryfound.io with the details. We take reports seriously, will acknowledge yours, and ask that you give us a reasonable chance to fix an issue before disclosing it publicly.

Contact

Found · brandon@tryfound.io