Security and privacy

This page sums up in plain words which data punchout.dev processes, where, and for how long. The legally binding text is the privacy policy.

What punchout.dev processes

• The cart page during a punchout. While a punchout is running, punchout.dev processes the content of the cart page to read the line items. With a known cart container, it reads only that part of the page (Cart detection).
• The page during cart detection. In setup mode, punchout.dev reads the page you are on when you click Detect cart or Check this area, and only then.
• Buyer credentials. Domain, identity and label, and the secret as a one-way hash.
• Portal accounts. Your email address, and your password as a one-way hash.

Whatever it reads from a shop page, punchout.dev always leaves out the contents of fields for passwords, email addresses, phone numbers and card data.

On the shop page

• Without a punchout or a setup link, the tag sends nothing.
• The tag reads none of the shop’s cookies.
• The tag never puts a secret in a URL.

What the buyer system receives

At the end of a punchout, the buyer’s browser hands the cart to the return address that the buyer system sent when it opened the shop. The transfer carries the items the buyer reviewed in the panel, never a secret or a password. To limit where carts may go, use Allowed return hosts (Connect a buyer).

Where

punchout.dev is hosted on AWS in Frankfurt, and the data stays in the EU. Every connection to punchout.dev is encrypted with TLS. Payments run through Stripe, and card and bank data never reach punchout.dev.

How long data is kept

Data	Kept
A punchout session and its cart	4 hours
A test punchout result	30 days after it arrived
A provisional shop from the instant tag	7 days, unless it is claimed
A portal account that is never confirmed	7 days
Database backups	14 days
Your account, shops and buyer credentials	For the duration of the contract, see the privacy policy
The audit log	Not deleted with the organisation. See Team

Credentials and links

• Buyer secrets and portal passwords are stored only as one-way hashes. Nobody can read them back, punchout.dev included. A buyer secret is shown once, when it is created or rotated.
• Setup links, invitation links and test punchout links are random and cannot be shown again. If one is lost, create a new one.

Logs

punchout.dev logs what it needs to run the service, such as the time, the shop and the outcome of an action. Cart contents, email and postal addresses, secrets, passwords and shop URLs never go into a log.

The portal

• Your sign-in is a 12-hour session that renews while you work.
• A failed sign-in says only that the address or the password is wrong. After several wrong passwords, the account is locked for a while.

Auto-login

With auto-login, punchout.dev signs a short-lived token, and the shop plugin checks it with the public key lines shown in the portal. A token is valid for 120 seconds, works once, belongs to one shop and leads only to a page inside that shop. The shop holds no key that could create tokens. Auto-login has the details.

For a data processing agreement or a question about these facts, use the contact on the privacy policy page.