Trust Center

What we do to protect your store, how we keep it running, and where to find everything else.

Protections built into your store

These are in the product today, and each one lives in your dashboard, so you can check it yourself.

Two-factor sign-in

Add a six-digit code from an authenticator app to your sign-in, with backup codes in case you lose your phone.

Turn it on in Settings → Account

Audit history

See who did what in your store, and when, including actions by your collaborators.

Settings → Audit history

Invite people, not passwords

Collaborators get their own login through an email invite, so you never have to share yours.

Settings → Collaborators

Card details go straight to Stripe

At checkout, buyers type their card details into fields provided by Stripe, so card numbers never pass through E2C's servers.

Applies to card payments

Your money goes straight to you

E2C never holds your sales. Buyers pay into your own payment account, so there is no E2C balance to wait on.

  • Paid into your own account

    Card payments are charged on your own Stripe account and PayPal payments go to your own PayPal account. Your payouts follow their schedule, not ours.

  • One fee, taken at checkout

    E2C's 1.99% fee is taken at the moment of payment, and it's all we take. Stripe or PayPal charge their usual processing fee.

  • An email when payments change

    We email you when Stripe or PayPal is connected to your store, and when you disconnect one from your dashboard.

You decide what apps can do

Anything you connect gets only the permissions you give it, and every change it makes shows up in your audit history under its name.

AI assistants

Connect an AI app to your store and choose what it may do on the consent screen.

  • Read your storeAlways
  • Build and edit your storeOn by default
  • Handle orders and messagesOff by default
  • Delete anything, refund or cancel orders, or change your store name, currency or paymentsNever

Disconnect any app in Settings → AI integration. Any access it already has runs out in at most 15 minutes.

Developer API keys

Give each key only the permissions it needs, set it to expire, and revoke it whenever you like. We keep only a fingerprint of each key, so you see the full key once.

  • Read orders, products, services, events, customers or reportsYou choose
  • Add and edit products and categoriesYou choose
  • Delete anythingNever

Manage keys in Settings → API keys.

Under the hood

  • Passwords are stored only as one-way bcrypt hashes.
  • Repeated failed sign-ins and two-factor codes are slowed down.
  • Resetting your password signs out every other session.
  • Payment notifications from Stripe and PayPal are signature-checked before we act on them.
  • Browsers are told to always connect over HTTPS.

Checked from outside our own servers

Our public status page runs automated checks from several regions, so an outage on our hosting can't hide itself. It also explains exactly how it decides that something is down.

View live status

How it's measured Incident history Updates feed

Check live status

  • Storefronts
  • Cart and checkout
  • Seller dashboard
  • Public API

Last 30 days, read from status.e2c.store

Everything else

Your data

Help

What's new

Questions about trust or security? Email [email protected].

Last reviewed