Security requirements
Integrators share responsibility for protecting merchant and shopper data.
Transport & data
| Control | Requirement |
|---|---|
| TLS | TLS 1.2+; 1.3 preferred on all API and webhook endpoints |
| Encryption at rest | Platform encrypts merchant secrets; partners encrypt their copies of keys |
| PAN / CVV | Never sent to or stored by IoneShop — use PSP tokens only |
| PII | Minimize; mask in logs; follow GDPR retention |
API key security
- Server-side only
- Secrets manager; no git, screenshots, tickets
- Rotate on staff offboarding and ≤ 90 days
- Separate sandbox / production
- IP allowlisting where offered by plan
Secrets management
- Use scoped API keys for server integrations today (OAuth 2.0 for partner apps is in development)
- When OAuth ships, prefer short-lived access tokens for third-party apps
- Webhook signing secrets treated like API keys
- Never log
Authorization, signatures, or raw secrets
Network controls
- Production webhook receivers on HTTPS
- Optional allowlist of IoneShop egress IPs (published for Enterprise)
- WAF in front of public receivers recommended
Audit & access
- Platform audits admin/API key actions
- Partners must retain their own access logs for integrations
- MFA required for Merchant BO human users where enabled by plan
- Least privilege scopes — see Authorization
Incident expectations
If you suspect key leakage or cross-tenant data in a response: revoke credentials, preserve logs with request_id, notify [email protected] (or your Enterprise IR contact). Do not quietly “patch and hope”.
Independent researchers: see the public Vulnerability Disclosure Policy and security.txt.