Security at G-Integrator

Last Modified: November 5, 2026

G-Integrator builds integration services that connect business platforms such as Shopify, Stripe, QuickBooks Online, HubSpot, Zoho, and Salesforce. Customers trust us with access to commercial and accounting data, and we treat protecting that access as a core product requirement. This page summarizes the security practices that apply across our services, including the MCP Integrator Commerce Finance Ops service.

Data Encryption

  • In transit: all traffic between your browser or AI agent and our services, and between our services and connected platforms, is encrypted with HTTPS/TLS.
  • At rest: platform credentials (OAuth access and refresh tokens, restricted API keys) are encrypted with AES-256 authenticated encryption before they are written to the database. Encryption keys are kept in a managed secrets store, separate from the data they protect, and are never committed to source code.

Access to Your Platforms

  • OAuth-based authorization: connections to platforms are established through each vendor's official OAuth flow. We never ask for your platform passwords.
  • Least-privilege scopes: we request the narrowest scopes a feature needs — for example, read-only access to orders, payouts, and accounting records. Services that only read data hold no write permissions.
  • Revocable at any time: you can disconnect a platform from the service's connections page or revoke access from the vendor's own security settings. Disconnecting invalidates the stored credentials.

Service and Account Security

  • Standards-based API security: programmatic access to the MCP Integrator service is protected with OAuth 2.1, including PKCE and short-lived, signed access tokens. Anonymous requests are rejected.
  • Passwordless sign-in: dashboard sign-in uses single-use, time-limited codes delivered by email, with rate limiting and attempt caps. No reusable passwords are stored.
  • Tenant isolation: every customer workspace's data is segregated by tenant, and every read and write is scoped to the authenticated workspace.
  • Audit logging: operational events are recorded in audit logs that capture what ran, when, and whether it succeeded — without duplicating the contents of your platform records.

Infrastructure

  • Our services run on Amazon Web Services inside private networks; databases are not exposed to the public internet.
  • Public endpoints are fronted by content delivery networks with DDoS protection and modern TLS policies.
  • Deployments are automated and reproducible; secrets are supplied through environment configuration and managed parameter stores, never through source code.
  • Service health and error rates are monitored with automated alerting.

Data Handling

We access platform data only to provide the user-facing features you use. We do not sell customer data, do not use it for advertising, and do not use it to train generalized artificial-intelligence or machine-learning models. See the Privacy Policy and the MCP Integrator Privacy Notice for details on what is accessed, what is stored, and how to request deletion.

Reporting a Vulnerability

If you believe you have found a security vulnerability in a G-Integrator service, please email [email protected] with the subject "Security". Include the steps needed to reproduce the issue. We investigate all good-faith reports, confirm receipt, and keep you informed as we remediate. Please do not access data that is not yours or degrade the service while testing.

Contact

Questions about our security practices: [email protected].