Security

Canora is a product of Cast Hook LLC (“Cast Hook,” “we,” “us”). Merchants trust us with their catalogs, inventory, orders and customer records, and with access to the systems that data comes from. This page explains how we protect it today. We describe only what is in place now.

For what data we collect, which service providers receive it and your rights over it, see our Privacy Policy. See also our Compliance page and Terms of Service.

Canora's application, database and file storage are hosted in an OVHcloud data center in the United States. Some of the service providers listed on our Sub-processors page may process data in other locations.

In transit. Connections to Canora over the internet are encrypted with TLS (HTTPS). This covers the dashboard (in a browser or on your phone), our API, and updates sent to us by the platforms you connect.

Store credentials. When you connect a store platform, the access tokens and API keys it issues are encrypted before they are saved. Each credential is encrypted with AES-256-GCM under its own key, and that key is in turn protected by AWS Key Management Service (KMS).

Passwords and API keys. When you sign in, your password is passed to Auth0, our sign-in provider, which checks it. Canora does not store it. Personal API keys are shown to you once and stored only as a one-way hash.

Password sign-in is handled by Auth0 (Okta). You can also sign in with a passkey, which Canora checks itself: we store only the passkey's public key, and your fingerprint, face or screen lock never leaves your device. A passkey counts as multi-factor sign-in on its own. You can also use an authenticator app. Some sensitive actions, such as granting our support team access to your workspace, ask you to confirm with your passkey or a fresh authenticator code even if you are already signed in. Your dashboard session is kept in a secure, HttpOnly cookie that expires automatically.

Personal API keys let you connect your own scripts and tools. You create them while signed in to the dashboard and choose which permissions each key has. Keys expire after 90 days by default, or at most one year, and you can revoke a key at any time. API keys cannot manage store connections, stored credentials, billing or account settings.

Notifications that Shopify, Stripe and other connected platforms send to Canora are checked for a valid signature before we act on them.

Each merchant's data belongs to its own workspace. As a second layer behind the application's own checks, our database applies row-level security to workspace data, so a query made for one workspace sees only that workspace's rows. Automated tests check that this protection stays in place.

Apart from the support conversations you have with us, our support staff accounts cannot see your workspace unless you grant access. A support staff member can send an access request in the support chat, and a workspace owner or admin can accept it after confirming with a passkey or an authenticator code.

Access you grant is time-limited, to at most 8 hours, and you can end it at any time. Granting and ending access are recorded in your workspace's audit log.

Separately, access to our production systems is restricted to authorized Cast Hook personnel who need it to operate and maintain Canora.

Canora records important actions in an audit log for each workspace: what changed, who or what made the change, and when. Entries are chained together with cryptographic hashes, which helps us detect later changes to individual entries.

We collect operational metrics, such as request counts, timings and error rates, to monitor the Service. They do not include your catalog, order or customer records. Application logs are not sent to an outside logging service.

Canora uses AI to draft product descriptions, extract product attributes and prepare product images. It can also screen incoming product reviews for spam and abuse, and suggest how the columns of a spreadsheet you import map to product fields. To do this we send product information, product images, review text and a few sample rows of imported spreadsheets to AI providers, listed on our Sub-processors page.

Most AI requests go through OpenRouter. On every OpenRouter request we turn data collection off, so OpenRouter sends the request only to model providers that, according to OpenRouter, do not store or train on request data. Our other AI providers handle data under their own terms; our Compliance page has more detail.

To look up product details, we send only barcodes or product categories to product lookup services.

Our database is backed up every day, and changes are archived continuously in between. Database backups are kept within our hosting environment for a limited period. We do not currently keep a separate off-site copy.

We do not currently offer an uptime guarantee.

Changes to Canora run through automated checks, including type checks and tests. We scan our production software dependencies for known high- and critical-severity vulnerabilities on every change and once a day, and check that packages come only from the official npm registry.

Cast Hook does not have a SOC 2 report or an ISO 27001 certification, and Canora has not had an independent security audit or penetration test.

If your business needs a security questionnaire completed, email us at trust@canora.ai.

If we learn of a security incident that affects your data, we will work to contain it, and we will notify affected account holders and explain what happened and what we are doing about it. While we investigate, we can stop syncing for a single workspace or across the whole platform.

If you believe you have found a security vulnerability in Canora, please email trust@canora.ai. Include a description, the steps to reproduce it, and the affected page, URL or feature.

When testing, please:

• Use only your own account and workspace. Do not access, change or delete other people's data. If you reach data that is not yours, stop and tell us.
• Do not run denial-of-service tests, send spam, or try to trick our staff or customers.
• Keep only the data you need to show the issue, do not share it, and delete it once you have reported it.
• Test only Canora itself. Our service providers and the platforms you connect, such as Shopify or Stripe, have their own rules.
• Give us reasonable time to fix the issue before you share it publicly.

Safe harbor. If you make a good-faith effort to follow these rules while finding and reporting a vulnerability, we will consider your research authorized. We will not bring or support legal action against you for it, including under computer misuse or anti-circumvention laws or our Terms of Service, and if someone else takes legal action against you for research covered here, we will make it known that it was authorized. This safe harbor does not cover data that is not yours, and it cannot bind other companies, including our service providers. If you are unsure whether something is allowed, ask us at trust@canora.ai first.

We will confirm that we received your report and keep you updated while we work on it. We do not run a bug bounty program and do not pay for reports.

For security questions, email trust@canora.ai. For privacy requests, see our Privacy Policy.

Cast Hook LLC · trust@canora.ai