Is my store safe on CartWhizz? Security, backups and data ownership

Short answer: yes. Every CartWhizz store runs over HTTPS with a free, auto-renewing SSL certificate, keeps its data in its own separate database, and is backed up automatically every night. Passwords are stored only as secure hashes, each staff member gets their own login, and you can export your products, customers and orders at any time. Your domain and your data stay yours.

Secure connections (HTTPS)

Every store is served over HTTPS, both on its free cartwhizz.com address and on your own domain. When you connect a domain, CartWhizz issues a Let's Encrypt SSL certificate automatically and renews it about 30 days before it expires, so you never have to buy, install or remember to renew one. Shoppers see the padlock in their browser, and data between them and your store is encrypted.

Your store's data is kept separate

Each CartWhizz store has its own database. Your products, orders and customers are not mixed into a shared table with other stores' data, which keeps each store's data cleanly separated and lets us back up and restore one store without touching any other.

Accounts and logins

• Verified owners: every store owner's email address is verified with a one-time code before the store is created.
• Strong passwords: owner passwords need at least 10 characters with upper and lower case letters, a number and a symbol.
• Hashed passwords: passwords are stored only as bcrypt hashes, never as readable text, so not even our team can see them.
• Slowed-down guessing: repeated wrong login attempts are throttled, which makes guessing passwords impractical.
• Separate staff logins: give each person who helps you their own staff account instead of sharing your password, and remove it when they leave. Starter includes 1 staff account, Growth 3, Pro 15 and Enterprise unlimited.

Backups

Your store's database, which holds your products, orders, customers and settings, is backed up automatically every night on our servers.

For extra protection, we can also keep off-site copies of a store's backups in separate cloud storage, so a copy survives even if a server is lost. When off-site copies are switched on for your store, you see the date of each backup in your admin and can restore your store from one. Only the store owner (or our support team) can start a restore, and to keep your data private, backup files are not downloadable from the admin. Ask us if you would like off-site copies for your store.

Product images and other uploads are stored separately on our servers.

Sensitive settings are encrypted

Sensitive platform credentials, such as the keys for off-site backup storage, are stored encrypted, and secret keys are never shown again in the admin once they are saved.

You own your data

• Export any time: download your products, categories, brands, customers and orders as CSV or Excel files from your admin.
• Your domain is yours: you buy and renew it with your own registrar. You can point it elsewhere whenever you want.
• Your customers are yours: customer records belong to your store. CartWhizz also has tools to export or delete a customer's personal data when they ask.

Payments

Online payments go through the payment gateway you connect, such as Razorpay, PayU or PhonePe, which handles the payment itself and settles the money to your bank. Gateways are regulated and have their own security requirements, and your gateway settles your sales straight to your bank account.

Reliability and support

Hosting is included on every plan, and our team monitors the platform. When releasing updates, we take fresh backups of every store first and switch to the new version in one step, with the previous version kept ready to switch back. Support is available by email and WhatsApp on every plan, and the Enterprise plan includes priority support and an SLA.

What you can do to keep your store safe

• Use a unique, strong password for your store admin and your email account.
• Give staff their own accounts, with only the access they need.
• Keep your payment gateway keys private and change them if someone leaves.
• Export your products and orders regularly for your own records.
• Be wary of emails asking for your password. We will never ask for it.

Frequently asked questions

Is my CartWhizz store secure?

Yes. Every store uses HTTPS with an automatic SSL certificate, keeps its data in its own database, stores passwords as hashes and is backed up every night.

Does CartWhizz back up my store?

Yes. Every store's database is backed up automatically every night. Off-site copies in separate cloud storage can be switched on for a store, and the owner can restore from them.

Can I download my store data?

Yes. You can export products, categories, brands, customers and orders as CSV or Excel files from your admin at any time.

Do I need to buy an SSL certificate?

No. CartWhizz issues and renews a free SSL certificate for your store and your own domain automatically.

Who owns my customer data?

Your store does. You can export your customer list at any time.

Questions about security we have not answered? Talk to our team, or start your free trial.