Your data is our top priority at Ordergroove
Ordergroove constantly strives to deliver the best-in-class services, reliability and security for all our customers. Ordergroove is compliant with the Payment Card Industry (PCI) and the General Data Protection Regulation (GDPR), holds a SOC 2 Type II attestation, and stores data securely with Google Cloud Platform. Our data is encrypted both in transit (TLS 1.2+) and at rest (AES-256), and we integrate directly with your eCommerce platform so that we never receive or store any payment sensitive information.
For full details on our security and compliance, visit the Ordergroove Trust Center.
Compliance & Certifications
SOC 2 / PCI Compliance
Ordergroove's SOC 2 and PCI compliance information lives in our Trust Center, where you can review our certifications and request access to security reports.
GDPR Compliance
The General Data Protection Regulation (GDPR) is a data regulation enacted by the European Union to safeguard the rights of consumers in the EU, superseding the 1995 Data Protection Directive and increasing requirements for data security and privacy beyond the Directive. The GDPR became enforceable on May 25, 2018.
Ordergroove is GDPR Compliant. Please refer to this document in order to submit Data Subject Access Requests (DSARs) to Ordergroove.
CCPA Compliance
The California Consumer Privacy Act of 2018 (CCPA) gives consumers more control over the personal information that businesses collect about them, and the CCPA regulations provide guidance on how to implement the law.
Ordergroove is CCPA Compliant. Please refer to this document in order to submit Data Subject Access Requests (DSARs) to Ordergroove.
Customer Payment Information
Integrating with Ordergroove means that you get the best security settings out of the box:
- We do not have access to your customers’ Primary Account Number (PAN) or credit card numbers
- We receive a token ID as a payment identifier during enrollment that we send back to your platform for processing recurring orders
- For the best customer experience in the Subscription Manager and easier management of expired credit cards, we can display information like the last four digits of the credit card and the expiration date
- We require 2-factor authorization for data exports that contain a customer's Personally Identifiable Information (PII).
API Key Best Practices
When you create an Application API key in the Ordergroove Admin, you choose its permissions: Read Only or Read and Write, and whether it can run bulk queries, which return records across multiple customers. Give each key only the access it needs. You own the responsibility to safeguard your keys and are responsible for any use of them to access and perform any actions in the Ordergroove system.
The following are some of the best practices that you should follow:
- DO NOT embed API keys directly in code. API keys that are embedded in code can be accidentally exposed to the public. Instead of embedding your API keys in your applications, store them in environment variables or in files outside of your application’s source code.
- DO NOT store API keys in files inside your application’s source tree. If you store API keys in files, keep the files outside your application’s source tree to help ensure your keys do not end up in your source code control system. This is particularly important if you use a public source code management system such as GitHub or BitBucket.
-
DO NOT store or expose your API keys on the client-side.
- If you are developing a web app, always store your API keys in a backend server that orchestrates the calls to the Ordergroove API. DO NOT expose the key to any browser.
- If you are developing a mobile app, it’s equally important to NOT store your API keys in the mobile app.
- If you need to make a call from the front end, create a proxy endpoint in your backend and make the calls to Ordergroove API from there.
- Tools exist today that allow a malicious actor to reverse engineer your app and retrieve API keys. Additionally, if you ever need to rotate your API keys, you will need to rely on your users to update your app without which your app will stop working. Instead, we recommend storing third-party API keys such as the ones issued by Ordergroove in a backend server you own.
- Review your code before public release to ensure your code does not contain API keys or any other private information. Ensuring your code is peer reviewed will strengthen code quality and shared responsibility.
- Do not share the key with anyone unless they absolutely need that access to run your applications.
- Never share the key through a web based communication (email, instant messenger, print, screenshare, picture, screenshots). If you must share the key with someone use a Vault or Password Manager.
- Do not reuse the same API Key across multiple applications. You should generate a separate API Key for each application.
- If your API key is compromised, disable it right away: in the Ordergroove Admin, select Developers > API Keys, open the three-dot menu at the end of the key’s row, select Disable, and type DISABLE to confirm. You should also immediately contact Ordergroove to revoke the API Key and generate a new one.
Reporting a Security Concern
If you would like to report a security concern or are aware of an incident, please email us at security@ordergroove.com or our support team.