Data kept separate per store
Every record belongs to one store, and widget and dashboard requests are checked against that store.
Feature · Security
Your store data, protected by design.
Zubby keeps each store's data separate, encrypts the credentials you connect, gives your team role-based access with two-factor sign-in, records important changes in an audit log, and processes authorized privacy requests through background jobs.
Plans from $49/month. Try Growth for 14 days.
Included in every plan.
What it does
A sales agent works with sensitive data: your catalog and orders, and your shoppers’ questions and contact details. Zubby treats each store as its own boundary and checks every request against it.
Our trust center publishes the sub-processors we use, our data processing agreement and our responsible AI policy, so you can review them before connecting a store.
Capabilities
What you get
Encrypted credentials
Platform tokens and integration keys are encrypted at rest and used only for your store.
Team roles and two-factor sign-in
Give teammates only the access they need, and protect accounts with two-factor authentication.
Audit log and privacy requests
Important changes are recorded in an audit log, and authorized access, erasure and redaction requests are processed by background jobs.
How to get started
Review the trust center
Read our sub-processors, DPA, privacy policy and responsible AI policy.
Set up your team
Invite teammates with the right roles and turn on two-factor sign-in.
Set your data rules
Choose what the agent can do with orders, and add your consent and privacy wording to the widget.
Good to know
- You remain responsible for your own privacy notice and for the consent you collect from shoppers.
- Order actions that move money stay off until you enable them.
- Questions about security? Contact us before you connect your store.
Frequently asked questions
Is my store's data kept separate?
Yes. Every record belongs to a single store, and each request is checked against the store it comes from before any data is read or changed.
How are my API keys and tokens protected?
Credentials you connect, such as platform tokens and integration keys, are encrypted at rest. Authentication checks use the appropriate token, hash or signature verification for that credential.
How do you handle GDPR requests?
Authorized requests, including Shopify privacy webhooks, can enter background access, erasure and redaction jobs with retries. The merchant or service operator still needs to verify the request, its scope and the applicable deadline.
Do you hold security certifications?
Zubby does not currently publish a SOC 2 or ISO 27001 report. See the trust center for our sub-processors, DPA and responsible AI policy, or contact us with security questions.
Keep exploring
Try it on your store
See Zubby answer from your own catalog.
Start the 14-day Growth trial, connect your WooCommerce store, and read real shopper conversations before you open the assistant to all traffic.