Trust
Security and privacy
What procurement and IT teams ask before approving a supplier connection, answered in one page.
- Hosting
- Enterprise cloud, dedicated on request
- Encryption
- TLS in transit, encrypted at rest
- Credentials
- Only the last 4 characters visible
- Store isolation
- Reverse proxy in front of your shop
- GDPR
- DPA and sub-processor list
Details
How the gateway handles your data
Data processed
Your store URL, the catalogue and cart data requested by the buyer’s system, and the credentials you configure for each buyer.
Credentials
Shared secrets, passwords and API keys are stored encrypted and never shown in full.
Session logs
Every session and message is logged so you can trace what happened with each buyer.
Access
Dashboard access per user; API keys can be rotated at any time.
Documents
Contracts and policies
- Ask us for the DPA
- Website privacy policy
- Platform terms and privacy policy: shown at sign-up
FAQ
Security questions
Where is the gateway hosted?
On enterprise cloud infrastructure; the provider is named in the DPA. If your company needs a dedicated environment, dedicated hosting is available on request.
Do you store my buyer’s credentials?
Yes, encrypted. Only the last 4 characters are shown in the dashboard.
Does the gateway change my store or server?
No. It sits in front of your store as a reverse proxy for PunchOut sessions only; your server, theme and checkout stay as they are.
Is a DPA available?
Yes, a data processing agreement with the list of sub-processors, under the GDPR.
30-day free trial · no credit card
Your buyer is waiting. Let’s launch.
Install the plugin today and run your first test session this afternoon. If your deadline is close, tell us and we will handle your request with priority.