Customer Data

Data Protection

• All API communication uses HTTPS/TLS
• Customer passwords are hashed with bcrypt
• Payment data is tokenized — raw card numbers never stored
• Access tokens expire after 24 hours
• API keys can be rotated at any time

Data Access

Customer data is only accessible with:

• A valid Bearer token (customer's own data)
• A secret key sk_* (admin access to all customers)

Public keys (pk_*) cannot access individual customer data.

Next Steps

• API Key Security
• Rate Limiting