Security

Store access tokens are never stored in plaintext. They're encrypted at rest with AES-256-GCM (authenticated encryption — tampering with a stored value is detectable, not just unreadable) before being written to the database, and decrypted only in memory, on demand, when BrandForge needs to call your store.

This is the core rule the platform is built around: AI never edits a live store on its own. Every change — new product copy, SEO fields, images, design updates — is created as a pending approval. A merchant has to review and explicitly approve it before anything is pushed to the live store. There is no setting that skips this step.

Before an approved change is published, BrandForge captures a backup of the prior state. If a published change needs to be undone, that backup is what rollback restores from.

We don't claim a security certification we don't hold. What we can say plainly: sensitive credentials are encrypted at rest, access to store data is scoped to what each feature needs, and publishing to a live store always requires a human decision. If you find a security issue, please email security@trybrandforge.com.