Trust & Security

This page is maintained by Neurovia Systems Inc to answer common security and privacy questions about ShipBoost. It describes controls that are in place today.

Last updated July 2026

This is app-owner-maintained content, not an independent certification, audit report or statement of regulatory compliance. If your procurement process needs formal documentation, email contact@accessneurovia.com and we will tell you exactly what we can and cannot provide.

Authentication

Accounts sign in with email and password, or with Google.
Passwords are handled by our managed authentication provider and are never stored by us in readable form.
Sessions are issued as short-lived tokens; signing out clears the session and any cached account data in the browser.
Every dashboard, studio and integration route requires an authenticated session before it will load.

Data isolation

Every request to read or write stores, bars and analytics is executed as the signed-in user, and row-level access rules restrict each account to its own records. One merchant cannot list, read or modify another merchant's stores, bar configurations or performance data, including by guessing identifiers.

The public widget endpoint

Your storefront loads bars from a read-only public endpoint. It is deliberately narrow:

It accepts a store key and nothing else, and rejects anything that is not a well-formed key.
It returns bars only for stores that are marked live, and only bars that are currently active.
It returns presentation fields only: messages, colours, thresholds, timers and targeting. No account email, no plan details, no analytics.
It is read-only. There is no public write path into your data.

The store key is a public identifier meant to appear in your storefront HTML. It cannot be used to sign in, to change your bars, or to read your dashboard.

Data in transit and at rest

All traffic between browsers, the widget endpoint and our backend uses encrypted HTTPS connections. Data is stored in our managed cloud backend, which encrypts data at rest. We do not offer end-to-end encryption, and we do not claim it.

What the widget does on your shoppers' browsers

It collects no shopper-level or personally identifiable data.
Cart totals are read and rendered in the browser and never transmitted to us.
It sets no tracking or advertising cookies. Evergreen timers use one non-identifying local storage timestamp per bar.
It renders into its own container and does not modify your checkout, forms or existing page scripts.

Shared responsibility

Our platform

Authentication, per-account data isolation, encrypted transport and storage, and serving the public bar endpoint.

Neurovia Systems Inc

Keeping this page accurate, reviewing access to production systems, and responding to security reports and privacy requests.

You, the merchant

Protecting your login, controlling who can edit your theme, and making sure the claims in your bars are truthful and lawful.

Reporting a vulnerability

If you believe you have found a security issue, email contact@accessneurovia.com with steps to reproduce. Please give us a reasonable window to investigate before disclosing publicly, and do not access or modify data belonging to other merchants while testing. We will acknowledge your report and keep you updated on the fix.

Security contact

For incident questions, security reviews or privacy requests, the same address reaches us: contact@accessneurovia.com.