Security
Security & privacy by design
Sunday Rocket is built around the principles of least privilege, data minimization and transparent processing. This page summarizes the technical and organizational safeguards in place.
OAuth Authentication
Platform integrations use the official OAuth 2.0 authorization flow whenever supported. Platform credentials are never entered into or stored by Sunday Rocket.
Server-side Token Storage
Access and refresh tokens are stored server-side and never exposed to the browser or third parties.
Least Privilege Principle
Only the minimum API scopes required for the requested functionality are requested. No unnecessary permissions are requested or retained.
Secure Processing
Backend processing is performed on secure, access-controlled server infrastructure. All data in transit is protected using TLS encryption.
Privacy by Design
Personal data is only accessible to the authorized user who explicitly granted access through the connected platform. All authorization checks are performed server-side and scoped per user and per connected workspace.
Data Minimization
Only data strictly required to provide the requested functionality is retrieved and processed. Unrelated or unnecessary data is never requested.
No Marketing or Profiling
Data obtained through connected commerce platforms is never used for marketing, advertising, profiling, analytics unrelated to the requested service, or any other secondary commercial purpose. Platform data is processed exclusively to provide the functionality explicitly requested by the authorized user.
No Third-Party Sharing
Personal data is never sold, rented or shared for unrelated commercial purposes. Data is only processed to provide the requested service or where required by applicable law.
Access Control
Every connected workspace is logically isolated from every other workspace. Users can only access data belonging to workspaces they have explicitly authorized, and authorization checks are always performed server-side before connected platform data can be accessed.
Platform Security Philosophy
Sunday Rocket follows a platform-wide security model based on OAuth authorization, least privilege, data minimization and secure server-side processing.
These principles apply consistently across all current and future platform integrations, including marketplace, shop and commerce platform connections.