[{"data":1,"prerenderedAt":481},["ShallowReactive",2],{"bootstrap":3,"page-security":277},{"navigation":4,"globalConfig":196,"forms":218},{"headerSections":5,"headerFooterLinks":67,"footer":76,"legalLinks":153,"socialLinks":176},[6,39,44,50,57,62],{"hasSubMenu":7,"title":8,"links":9,"columns":38},true,"Product",[10,20,26,32],{"showTag":11,"_modelApiKey":12,"text":13,"subtitle":14,"icon":15,"isExternal":11,"link":16,"openForm":11},false,"navigation_link","Universal checkout","Sell anywhere","globe-simple",{"_modelApiKey":17,"slug":18,"title":19},"page","universal-checkout","Universal Checkout",{"showTag":11,"_modelApiKey":12,"text":21,"subtitle":22,"icon":23,"isExternal":11,"link":24,"openForm":11},"Distributed OMS","Manage orders","package",{"_modelApiKey":17,"slug":25,"title":21},"distributed-oms",{"showTag":11,"_modelApiKey":12,"text":27,"subtitle":28,"icon":29,"isExternal":11,"link":30,"openForm":11},"Promotion engine","Automated discounts","seal-percent",{"_modelApiKey":17,"slug":31,"title":27},"promotion-engine",{"showTag":11,"_modelApiKey":12,"text":33,"subtitle":34,"icon":35,"isExternal":11,"link":36,"openForm":11},"POS system","Operate stores","devices",{"_modelApiKey":17,"slug":37,"title":33},"pos-system",2,{"hasSubMenu":11,"showTag":11,"_modelApiKey":12,"text":40,"isExternal":11,"link":41,"openForm":11,"title":40},"Pricing",{"_modelApiKey":42,"slug":43},"pricing_page","pricing",{"hasSubMenu":11,"showTag":11,"_modelApiKey":12,"text":45,"isExternal":11,"link":46,"openForm":11,"title":45},"Customers",{"_modelApiKey":47,"slug":48,"title":49},"customer_landing_page","customers","Customers page",{"hasSubMenu":11,"showTag":11,"_modelApiKey":12,"text":51,"isExternal":11,"link":52,"openForm":11,"form":54,"title":51},"Partners",{"_modelApiKey":17,"slug":53,"title":51},"partners",{"_modelApiKey":55,"slug":53,"name":56},"form","PartnersForm",{"hasSubMenu":11,"showTag":11,"_modelApiKey":12,"text":58,"label":59,"isExternal":7,"url":60,"openForm":11,"title":61},"Docs Hub","Learn more","https:\u002F\u002Fdocs.commercelayer.io\u002F","Docs",{"hasSubMenu":11,"showTag":11,"_modelApiKey":12,"text":63,"isExternal":11,"link":64,"openForm":11,"title":63},"Blog",{"_modelApiKey":65,"slug":66},"blog_landing_page","blog",[68,72],{"text":69,"link":70},"Sign in",{"_modelApiKey":12,"text":69,"isExternal":7,"url":71,"openForm":11},"https:\u002F\u002Fdashboard.commercelayer.io\u002Fsign_in",{"text":73,"link":74},"Sign up for free",{"_modelApiKey":12,"text":73,"isExternal":7,"url":75,"openForm":11},"https:\u002F\u002Fdashboard.commercelayer.io\u002Fsign_up",[77,89,109,132],{"hasSubMenu":7,"title":8,"links":78},[79,81,83,85,87],{"showTag":11,"_modelApiKey":12,"text":13,"subtitle":14,"icon":15,"isExternal":11,"link":80,"openForm":11},{"_modelApiKey":17,"slug":18,"title":19},{"showTag":11,"_modelApiKey":12,"text":21,"subtitle":22,"icon":23,"isExternal":11,"link":82,"openForm":11},{"_modelApiKey":17,"slug":25,"title":21},{"showTag":11,"_modelApiKey":12,"text":27,"subtitle":28,"icon":29,"isExternal":11,"link":84,"openForm":11},{"_modelApiKey":17,"slug":31,"title":27},{"showTag":11,"_modelApiKey":12,"text":33,"subtitle":34,"icon":35,"isExternal":11,"link":86,"openForm":11},{"_modelApiKey":17,"slug":37,"title":33},{"showTag":11,"_modelApiKey":12,"text":40,"isExternal":11,"link":88,"openForm":11},{"_modelApiKey":42,"slug":43},{"hasSubMenu":7,"title":90,"links":91},"Resources",[92,94,99,104,107],{"showTag":11,"_modelApiKey":12,"text":93,"isExternal":7,"url":60,"openForm":11},"Documentation",{"showTag":11,"_modelApiKey":12,"text":95,"label":95,"isExternal":11,"link":96,"openForm":11},"Agentic Commerce",{"_modelApiKey":17,"slug":97,"title":98},"agentic-commerce-whitepaper","Agentic Commerce Whitepaper",{"showTag":11,"_modelApiKey":12,"text":100,"isExternal":11,"link":101,"openForm":11},"Core concepts",{"_modelApiKey":17,"slug":102,"title":103},"headless-commerce","Headless commerce",{"showTag":11,"_modelApiKey":12,"text":105,"isExternal":7,"url":106,"openForm":11},"Changelog","https:\u002F\u002Fdocs.commercelayer.io\u002Fchangelog\u002F",{"showTag":11,"_modelApiKey":12,"text":63,"isExternal":11,"link":108,"openForm":11},{"_modelApiKey":65,"slug":66},{"hasSubMenu":7,"title":110,"links":111},"Company",[112,116,118,121,126],{"showTag":11,"_modelApiKey":12,"text":113,"isExternal":11,"link":114,"openForm":11},"Vision",{"_modelApiKey":17,"slug":115,"title":113},"vision",{"showTag":11,"_modelApiKey":12,"text":45,"isExternal":11,"link":117,"openForm":11},{"_modelApiKey":47,"slug":48,"title":49},{"showTag":11,"_modelApiKey":12,"text":51,"isExternal":11,"link":119,"openForm":11,"form":120},{"_modelApiKey":17,"slug":53,"title":51},{"_modelApiKey":55,"slug":53,"name":56},{"showTag":11,"_modelApiKey":12,"text":122,"isExternal":11,"link":123,"openForm":11},"Security",{"_modelApiKey":17,"slug":124,"title":125},"security","Security at Commerce Layer",{"showTag":11,"_modelApiKey":12,"text":127,"label":128,"isExternal":11,"openForm":7,"form":129},"Giveback","Giveback program",{"_modelApiKey":55,"slug":130,"name":131},"giveback","GivebackForm",{"hasSubMenu":7,"title":133,"links":134},"Get in touch",[135,140,145,149],{"showTag":11,"_modelApiKey":12,"text":136,"isExternal":11,"openForm":7,"form":137},"Contact",{"_modelApiKey":55,"slug":138,"name":139},"contact","ContactUsForm",{"showTag":11,"_modelApiKey":12,"text":141,"isExternal":11,"openForm":7,"form":142},"Book a demo",{"_modelApiKey":55,"slug":143,"name":144},"demo","RequestDemoForm",{"showTag":11,"_modelApiKey":12,"text":146,"label":147,"isExternal":7,"url":148,"openForm":11},"Support","Email support","mailto:support@commercelayer.io",{"showTag":11,"_modelApiKey":12,"text":150,"label":151,"isExternal":7,"url":152,"openForm":11},"Community","Discord community","https:\u002F\u002Fdiscord.gg\u002Fcommercelayer",{"hasSubMenu":7,"title":154,"links":155},"Legal",[156,161,165,169,173],{"showTag":11,"_modelApiKey":12,"text":157,"label":158,"isExternal":7,"url":159,"openForm":11,"htmlClassNames":160},"Terms","Terms and conditions","\u002Flegal-embed\u002Fterms-of-service","iubenda-nostyle no-brand iubenda-noiframe iubenda-embed",{"showTag":11,"_modelApiKey":12,"text":162,"label":163,"isExternal":7,"url":164,"openForm":11,"htmlClassNames":160},"Privacy","Privacy policy","\u002Flegal-embed\u002Fprivacy-policy",{"showTag":11,"_modelApiKey":12,"text":166,"label":167,"isExternal":7,"url":168,"openForm":11,"htmlClassNames":160},"Cookies","Cookie policy","\u002Flegal-embed\u002Fcookie-policy",{"showTag":11,"_modelApiKey":12,"text":170,"isExternal":7,"url":171,"openForm":11,"htmlClassNames":172},"Notice at collection","#","iubenda-cs-uspr-link",{"showTag":11,"_modelApiKey":12,"text":174,"isExternal":7,"url":171,"openForm":11,"htmlClassNames":175},"Privacy preferences","iubenda-cs-preferences-link",[177,180,184,188,192],{"title":178,"type":179,"url":152,"isExternal":7},"Discord","discord-logo",{"title":181,"type":182,"url":183,"isExternal":7},"Github","github","https:\u002F\u002Fgithub.com\u002Fcommercelayer",{"title":185,"type":186,"url":187,"isExternal":7},"Bluesky","bluesky-logo","https:\u002F\u002Fbsky.app\u002Fprofile\u002Fcommercelayer.io",{"title":189,"type":190,"url":191,"isExternal":7},"X","x-logo","https:\u002F\u002Fx.com\u002Fcommercelayer",{"title":193,"type":194,"url":195,"isExternal":7},"LinkedIn","linkedin","https:\u002F\u002Fwww.linkedin.com\u002Fcompany\u002Fcommerce-layer",{"pagesWithoutCtaPanel":197,"ctaPanel":198,"notification":208,"showApiResponseTime":11,"newsletterSignup":216},[],{"title":199,"subtitle":200,"ctas":201},"Ready to get started?","Discover how we can help your business.",[202,205],{"_modelApiKey":203,"text":204,"isExternal":7,"url":75,"openForm":11},"link","Get started for free",{"_modelApiKey":203,"text":206,"isExternal":11,"openForm":7,"form":207},"Contact us",{"_modelApiKey":55,"slug":138,"name":139},{"showNotification":7,"link":209,"linkText":210,"text":215},{"_modelApiKey":203,"text":210,"isExternal":11,"link":211,"openForm":11},"Read article",{"_modelApiKey":212,"slug":213,"title":214},"blog_post","payment-api-redesigned","Introducing our new Payments API. For humans and agents.","\u003Cp>Introducing our new Payments API. For humans and agents.\u003C\u002Fp>\n",{"ctaText":217},"Subscribe",[219,225,229,236,240,246,249,253,261,262,267,272,274],{"_modelApiKey":55,"slug":220,"pardotFormEmbedCode":221,"formEmbedMinHeight":222,"successTitle":223,"successCopy":224},"agentic-commerce","https:\u002F\u002Fcommercelayer.fillout.com\u002Ft\u002F5w4Khwgxr6us?whitepaper=agentic",520,"Thank you for your request!","We’ll be in touch soon to arrange a date and time for your personalized demo.",{"_modelApiKey":55,"slug":226,"pardotFormEmbedCode":227,"formEmbedMinHeight":228,"successTitle":223,"successCopy":224},"shopify","https:\u002F\u002Fform.fillout.com\u002Ft\u002FgVnLSmKZwRus",850,{"_modelApiKey":55,"slug":130,"pardotFormEmbedCode":230,"formEmbedMinHeight":231,"displayTitle":232,"copy":233,"successTitle":234,"successCopy":235},"https:\u002F\u002Fform.fillout.com\u002Ft\u002FmVDF8aAiofus",500,"We give back.","\u003Cp>Part of Commerce Layer's company ethos is to empathize and support one another: co-workers, customers, and community. We want to do our part to help nonprofit organizations and small businesses who may feel adversely affected by the current global economic climate, and as a result, need in-kind support to reach their customers.\u003C\u002Fp>\n\n\u003Cp>If this general description matches your organization’s needs, please tell us your story by completing the following form so we can consider helping your cause.\u003C\u002Fp>\n","Thank you!","We will contact you soon to learn more about your story.",{"_modelApiKey":55,"slug":237,"pardotFormEmbedCode":227,"formEmbedMinHeight":228,"displayTitle":238,"copy":239},"book-an-onboarding-session","Book an onboarding session","\u003Cp>Schedule some time and our devs will help you set up a Commerce Layer + Sanity store.\u003C\u002Fp>\n",{"_modelApiKey":55,"slug":241,"pardotFormEmbedCode":242,"formEmbedMinHeight":243,"displayTitle":244,"successTitle":234,"successCopy":245},"download-our-whitepaper","https:\u002F\u002Fform.fillout.com\u002Ft\u002F5YPWmy8oT7us?whitepaper=ComposableCommerce",450,"Download our whitepaper.","Check your inbox. You should receive a download link soon.",{"_modelApiKey":55,"slug":247,"pardotFormEmbedCode":248,"formEmbedMinHeight":243,"displayTitle":244,"successTitle":234,"successCopy":245},"download-the-content-and-commerce-whitepaper","https:\u002F\u002Fform.fillout.com\u002Ft\u002F5YPWmy8oT7us?whitepaper=ContentAndCommerce",{"_modelApiKey":55,"slug":250,"pardotFormEmbedCode":251,"formEmbedMinHeight":243,"displayTitle":244,"copy":252,"successTitle":234,"successCopy":245},"whitepaper","https:\u002F\u002Fform.fillout.com\u002Ft\u002F5YPWmy8oT7us?whitepaper=Jamstack","\u003Cp>Commerce Layer is the perfect platform for building commerce on the Jamstack. Convert any design into pixel perfect HTML pages. Connect a best-of-breed headless CMS. Go serverless and forget the hassle of managing complex infrastructures.\u003C\u002Fp>\n",{"_modelApiKey":55,"slug":254,"pardotFormEmbedCode":255,"formEmbedMinHeight":256,"displayTitle":257,"copy":258,"successTitle":259,"successCopy":260},"contact-links","https:\u002F\u002Fform.fillout.com\u002Ft\u002FeWPyhHGHT7us",750,"Contact us.","\u003Cp>Tell us about your project. Our team will reach out to you for a personalized offer.\u003C\u002Fp>\n","Thanks for your message!","We’ll be in touch soon to discuss your project details.",{"_modelApiKey":55,"slug":138,"pardotFormEmbedCode":255,"formEmbedMinHeight":256,"displayTitle":257,"copy":258,"successTitle":259,"successCopy":260},{"_modelApiKey":55,"slug":263,"pardotFormEmbedCode":227,"formEmbedMinHeight":228,"displayTitle":264,"successTitle":265,"successCopy":266},"demo-embed","Want to see it in action? Request a demo.","Thanks for your request!","We’ll be in touch soon to arrange a date and time for your free live demo.",{"_modelApiKey":55,"slug":53,"pardotFormEmbedCode":268,"formEmbedMinHeight":228,"displayTitle":269,"copy":270,"successTitle":234,"successCopy":271},"https:\u002F\u002Fform.fillout.com\u002Ft\u002F9MTkDWMUSqus","Become our partner.","\u003Cp>Join us and get our guidance in helping your clients succeed. Our partners are our ambassadors. We are committed to your success as much as you are.\u003C\u002Fp>\n","We will contact you soon to discuss the details of our partnership.",{"_modelApiKey":55,"slug":273,"pardotFormEmbedCode":268,"formEmbedMinHeight":228,"displayTitle":269,"copy":270,"successTitle":234,"successCopy":271},"partners-embed",{"_modelApiKey":55,"slug":143,"pardotFormEmbedCode":227,"formEmbedMinHeight":228,"displayTitle":275,"copy":276,"successTitle":265,"successCopy":266},"Get a free live demo.","\u003Cp>Get a personalized demo and learn more about what Commerce Layer can do for your company.\u003C\u002Fp>\n",{"displayTitle":278,"slug":124,"description":279,"buttons":280,"layout":281,"addFooterMarginTop":7,"_seoMetaTags":347,"seoMetaTags":410,"content":444,"partners":479,"technologyPartners":480},"Security you can trust","Commerce Layer stands as your compliance and security partner. Our industry certifications aren't just credentials, they're a promise of protection for your most critical business asset.",[],[282,322,343],{"_modelApiKey":283,"displayTitle":284,"titlePositioning":285,"titleTag":286,"subtitle":284,"copy":284,"columns":287,"cards":288,"cta":301,"ctaText":284,"darkTheme":7},"card_grid","","center","h3","3",[289,304,313],{"_modelApiKey":290,"cardStackSize":291,"copy":292,"displayTitle":293,"subtitle":294,"hideTitleIfImageIsSet":11,"image":295,"iconName":284,"iconColour":303,"link":301,"linkText":284},"information_card","Column","\u003Cp>Our SOC 2 Type 2 certification represents a rigorous approach to protecting your data. We've passed a comprehensive 12-month audit that validates:\u003C\u002Fp>\n\n\u003Cul>\n\u003Cli>Advanced cryptographic controls (AES-256 encryption)\u003C\u002Fli>\n\u003Cli>Multi-factor authentication\u003C\u002Fli>\n\u003Cli>Granular access management\u003C\u002Fli>\n\u003Cli>Continuous monitoring and threat detection\u003C\u002Fli>\n\u003Cli>Zero-trust network architecture\u003C\u002Fli>\n\u003C\u002Ful>\n","SOC 2 Compliance","The gold standard of security",{"url":296,"alt":297,"title":297,"width":298,"height":299,"format":300,"focalPoint":301,"customData":302},"https:\u002F\u002Fwww.datocms-assets.com\u002F35053\u002F1769675655-compliance-soc2.svg","Compliance - SOC 2",75,78,"svg",null,{},"violet",{"_modelApiKey":290,"cardStackSize":291,"copy":305,"displayTitle":306,"subtitle":307,"hideTitleIfImageIsSet":11,"image":308,"iconName":284,"iconColour":303,"link":301,"linkText":284},"\u003Cp>PCI DSS Level 1 Provider certification means we've implemented:\u003C\u002Fp>\n\n\u003Cul>\n\u003Cli>End-to-end payment data encryption\u003C\u002Fli>\n\u003Cli>Advanced tokenization of sensitive information\u003C\u002Fli>\n\u003Cli>Secure transmission protocols (TLS 1.3+)\u003C\u002Fli>\n\u003Cli>Dynamic fraud detection\u003C\u002Fli>\n\u003Cli>Continuous compliance monitoring\u003C\u002Fli>\n\u003C\u002Ful>\n","PCI DSS Compliance","Fortress-Level payment security",{"url":309,"alt":310,"title":310,"width":299,"height":311,"format":300,"focalPoint":301,"customData":312},"https:\u002F\u002Fwww.datocms-assets.com\u002F35053\u002F1769675655-compliance-pci.svg","Compliance - PCI DSS",60,{},{"_modelApiKey":290,"cardStackSize":291,"copy":314,"displayTitle":315,"subtitle":316,"hideTitleIfImageIsSet":11,"image":317,"iconName":284,"iconColour":303,"link":301,"linkText":284},"\u003Cp>Our ISO 27001 certification demonstrates a comprehensive framework for managing information security across:\u003C\u002Fp>\n\n\u003Cul>\n\u003Cli>Asset management\u003C\u002Fli>\n\u003Cli>Operational security controls\u003C\u002Fli>\n\u003Cli>Crypyographic protection\u003C\u002Fli>\n\u003Cli>Physical and environmental security\u003C\u002Fli>\n\u003Cli>Incident response procedures\u003C\u002Fli>\n\u003C\u002Ful>\n","ISO 27001 Compliance","Global information security management",{"url":318,"alt":319,"title":319,"width":320,"height":320,"format":300,"focalPoint":301,"customData":321},"https:\u002F\u002Fwww.datocms-assets.com\u002F35053\u002F1769675655-compliance-iso.svg","Compliance - ISO 27001",86,{},{"_modelApiKey":283,"displayTitle":323,"titlePositioning":285,"titleTag":324,"subtitle":284,"copy":284,"columns":325,"cards":326,"cta":301,"ctaText":284,"darkTheme":11},"Security principles","h2","2",[327,331,335,339],{"_modelApiKey":290,"cardStackSize":291,"copy":328,"displayTitle":329,"subtitle":284,"hideTitleIfImageIsSet":11,"image":301,"iconName":330,"iconColour":303,"link":301,"linkText":284},"\u003Cp>In accordance with the least privilege principle, access should be granted only to those with a legitimate business need.\u003C\u002Fp>\n","Least privileges","keyhole",{"_modelApiKey":290,"cardStackSize":291,"copy":332,"displayTitle":333,"subtitle":284,"hideTitleIfImageIsSet":11,"image":301,"iconName":334,"iconColour":303,"link":301,"linkText":284},"\u003Cp>Separation of duties helps prevent unauthorized access to sensitive information, data breaches, and other security incidents. It does this by ensuring that no single individual has complete control over a process or system.\u003C\u002Fp>\n","Separation of duties","identification-badge",{"_modelApiKey":290,"cardStackSize":291,"copy":336,"displayTitle":337,"subtitle":284,"hideTitleIfImageIsSet":11,"image":301,"iconName":338,"iconColour":303,"link":301,"linkText":284},"\u003Cp>In this context, we can assign a slightly different meaning to this acronym, such as "Keep Information Security Simple". By simplifying the software design and implementation details, the attack surface or vulnerability of the software is reduced.\u003C\u002Fp>\n","K.I.S.S.","vault",{"_modelApiKey":290,"cardStackSize":291,"copy":340,"displayTitle":341,"subtitle":284,"hideTitleIfImageIsSet":11,"image":301,"iconName":342,"iconColour":303,"link":301,"linkText":284},"\u003Cp>Instead of relying on security by obscurity, which hides the design of the software to ensure security, we believe that software design should be open for review while remaining independent from its implementation.\u003C\u002Fp>\n","Open design","shield-check",{"_modelApiKey":344,"displayTitle":345,"copy":346},"accordion","Your Security is Our Priority","\u003Ch3>Product security\u003C\u002Fh3>\n\n\u003Ch4>Authentication\u003C\u002Fh4>\n\n\u003Cp>Commerce Layer utilizes the \u003Ca href=\"https:\u002F\u002Fdocs.commercelayer.io\u002Fcore\u002Fauthentication\">OAuth 2.0 protocol\u003C\u002Fa>, which is an industry-standard, to handle client authorization. All API requests require authentication. Access tokens can be obtained by executing an authorization flow using a valid application as the client. The specific authorization flow depends on the grant type. Access tokens have a lifespan of 2 hours, while refresh tokens expire after 2 weeks.\u003C\u002Fp>\n\n\u003Ch4>Roles management\u003C\u002Fh4>\n\n\u003Cp>Commerce Layer supports a granular access control system at the resource level. Each access token is assigned a specific set of \u003Ca href=\"https:\u002F\u002Fdocs.commercelayer.io\u002Fcore\u002Froles-and-permissions\">permissions\u003C\u002Fa>. The client and the authorization flow determine the allowed actions for each resource.\u003C\u002Fp>\n\n\u003Ch4>Vulnerability management\u003C\u002Fh4>\n\n\u003Cp>In addition to ongoing automated malicious dependency scanning and static code analysis, our services undergo \u003Cstrong>Penetration Testing\u003C\u002Fstrong> at least once a year. We also perform quarterly external vulnerability scans.\u003C\u002Fp>\n\n\u003Cp>Any detected vulnerability is evaluated to determine if it is truly impacting our security. If that is the case, it is immediately assigned to the appropriate team and addressed with a \u003Cstrong>Service Level Agreement (SLA)\u003C\u002Fstrong> based on its severity. All relevant vulnerabilities are addressed within \u003Cstrong>90 days\u003C\u002Fstrong> of discovery.\u003C\u002Fp>\n\n\u003Ch3>Data security\u003C\u002Fh3>\n\n\u003Ch4>Encryption\u003C\u002Fh4>\n\n\u003Ch5>In transit\u003C\u002Fh5>\n\n\u003Cp>Commerce Layer utilizes \u003Cstrong>TLS 1.2\u003C\u002Fstrong> or higher for all data transmission over potentially insecure networks. We also enforce security features like \u003Cstrong>HSTS (HTTP Strict Transport Security)\u003C\u002Fstrong> to enhance the security of our data during transit. Our cloud infrastructure providers handle the management and deployment of server TLS Keys and certificates at the origin, while our CDN provider handles them at the origin.\u003C\u002Fp>\n\n\u003Ch5>At rest\u003C\u002Fh5>\n\n\u003Cp>All datastores, including databases, caches, storage buckets and filesystems, are encrypted at rest using industry-standard algorithms implemented by our cloud providers.\u003C\u002Fp>\n\n\u003Cp>Encryption keys are managed using the providers' key management systems. Application secrets are encrypted and securely stored using the providers' secrets and parameters management tool. Access to these values is strictly limited.\u003C\u002Fp>\n\n\u003Ch4>Data retention and removal\u003C\u002Fh4>\n\n\u003Cp>All data is removed or anonymized as soon as possible after deletion or service cancellation. Users can also \u003Ca href=\"mailto:support@commercelayer.io\">contact us\u003C\u002Fa> to have their data removed.\u003C\u002Fp>\n\n\u003Ch3>System security\u003C\u002Fh3>\n\n\u003Ch4>System configuration\u003C\u002Fh4>\n\n\u003Cp>System configuration and consistency are maintained by using standard, up-to-date images and infrastructure-as-code tools. This is done by replacing systems with updated deployments.\u003C\u002Fp>\n\n\u003Cp>When systems are deployed, they utilize up-to-date images that have been updated with configuration changes and security updates. After deployment, existing systems are decommissioned and replaced with up-to-date systems.\u003C\u002Fp>\n\n\u003Ch4>Access management\u003C\u002Fh4>\n\n\u003Cp>Commerce Layer employees are only granted access to applications they need based on their role, and automatically deprovisioned upon termination of their employment. Employee computers are secured with encrypted hard drives and firewalls, and access to central resources and third-party services are always encrypted and protected with two-factor authentication. \u003C\u002Fp>\n\n\u003Cp>\u003Cstrong>Commerce Layer employees do not have physical access to data centers, nor access to the underlying cloud infrastructure.\u003C\u002Fstrong>\u003C\u002Fp>\n\n\u003Ch3>Business continuity\u003C\u002Fh3>\n\n\u003Cp>Commerce Layer's services are built using leading cloud infrastructure providers. These providers offer fully redundant and distributed systems that run across multiple regions and availability zones. This means that even if a single component fails, there will be no significant service disruptions. Regular maintenance is performed on components without affecting availability.\u003C\u002Fp>\n\n\u003Cp>The providers' load balancers and \u003Cstrong>Content Delivery Networks (CDNs)\u003C\u002Fstrong> are capable of mitigating various types of \u003Cstrong>Distributed Denial of Service (DDoS)\u003C\u002Fstrong> attacks. Additionally, our backend systems can automatically scale to handle increased load.\u003C\u002Fp>\n\n\u003Cp>In the event of a disaster, our services and processes are designed to enable recovery within a few hours, with minimal to no data loss.\u003C\u002Fp>\n\n\u003Ch3>Corporate security\u003C\u002Fh3>\n\n\u003Ch4>Employee screening and policies\u003C\u002Fh4>\n\n\u003Cp>All of our employees undergo relevant background checks and security training. Additionally, they are required to sign confidentiality agreements.\u003C\u002Fp>\n\n\u003Cp>Access to customer data is limited to a small group of employees based on the principle of least privilege, meaning they only have access if it is necessary for their work. Furthermore, all access is monitored through dedicated audit controls.\u003C\u002Fp>\n\n\u003Ch4>Secure development practices\u003C\u002Fh4>\n\n\u003Cp>Commerce Layer provides comprehensive security training to all employees during onboarding and annually. In addition, engineers are required to attend an annual training session specifically focused on secure coding principles and practices.\u003C\u002Fp>\n\n\u003Cp>As part of our \u003Cstrong>Secure Development Lifecycle\u003C\u002Fstrong>, we conduct code peer reviews prior to deployment. Additionally, we make use of \u003Cstrong>CI\u002FCD\u003C\u002Fstrong> tools to enable efficient and systematic development, testing, and deployment of our product. This approach ensures prompt and effective resolution of potential bugs and security issues, while minimizing the risk of human error.\u003C\u002Fp>\n",[348,351,355,358,362,365,368,372,376,380,383,387,391,395,399,402,406],{"attributes":301,"tag":349,"content":350},"title","Security | Commerce Layer",{"attributes":352,"tag":354,"content":301},{"property":353,"content":350},"og:title","meta",{"attributes":356,"tag":354,"content":301},{"name":357,"content":350},"twitter:title",{"attributes":359,"tag":354,"content":301},{"name":360,"content":361},"description","To accomplish security at all levels, Commerce Layer makes use of best-in-class tools and guidelines.",{"attributes":363,"tag":354,"content":301},{"property":364,"content":361},"og:description",{"attributes":366,"tag":354,"content":301},{"name":367,"content":361},"twitter:description",{"attributes":369,"tag":354,"content":301},{"property":370,"content":371},"og:image","https:\u002F\u002Fwww.datocms-assets.com\u002F35053\u002F1699027651-security.jpg?auto=format&fit=max&w=1200",{"attributes":373,"tag":354,"content":301},{"property":374,"content":375},"og:image:width","1200",{"attributes":377,"tag":354,"content":301},{"property":378,"content":379},"og:image:height","630",{"attributes":381,"tag":354,"content":301},{"name":382,"content":371},"twitter:image",{"attributes":384,"tag":354,"content":301},{"property":385,"content":386},"og:locale","en",{"attributes":388,"tag":354,"content":301},{"property":389,"content":390},"og:type","article",{"attributes":392,"tag":354,"content":301},{"property":393,"content":394},"og:site_name","Commerce Layer",{"attributes":396,"tag":354,"content":301},{"property":397,"content":398},"article:modified_time","2026-07-15T13:50:30Z",{"attributes":400,"tag":354,"content":301},{"property":401,"content":284},"article:publisher",{"attributes":403,"tag":354,"content":301},{"name":404,"content":405},"twitter:card","summary_large_image",{"attributes":407,"tag":354,"content":301},{"name":408,"content":409},"twitter:site","@commercelayer",[411,412,414,416,418,420,422,424,426,428,430,432,434,436,438,440,442],{"attributes":301,"tag":349,"content":350},{"attributes":413,"tag":354,"content":301},{"property":353,"content":350},{"attributes":415,"tag":354,"content":301},{"name":357,"content":350},{"attributes":417,"tag":354,"content":301},{"name":360,"content":361},{"attributes":419,"tag":354,"content":301},{"property":364,"content":361},{"attributes":421,"tag":354,"content":301},{"name":367,"content":361},{"attributes":423,"tag":354,"content":301},{"property":370,"content":371},{"attributes":425,"tag":354,"content":301},{"property":374,"content":375},{"attributes":427,"tag":354,"content":301},{"property":378,"content":379},{"attributes":429,"tag":354,"content":301},{"name":382,"content":371},{"attributes":431,"tag":354,"content":301},{"property":385,"content":386},{"attributes":433,"tag":354,"content":301},{"property":389,"content":390},{"attributes":435,"tag":354,"content":301},{"property":393,"content":394},{"attributes":437,"tag":354,"content":301},{"property":397,"content":398},{"attributes":439,"tag":354,"content":301},{"property":401,"content":284},{"attributes":441,"tag":354,"content":301},{"name":404,"content":405},{"attributes":443,"tag":354,"content":301},{"name":408,"content":409},[445,456,462],{"_modelApiKey":283,"displayTitle":284,"titlePositioning":285,"titleTag":286,"subtitle":284,"copy":284,"columns":287,"cards":446,"cta":301,"ctaText":284,"darkTheme":7},[447,450,453],{"_modelApiKey":290,"cardStackSize":291,"copy":292,"displayTitle":293,"subtitle":294,"hideTitleIfImageIsSet":11,"image":448,"iconName":284,"iconColour":303,"link":301,"linkText":284},{"url":296,"alt":297,"title":297,"width":298,"height":299,"format":300,"focalPoint":301,"customData":449},{},{"_modelApiKey":290,"cardStackSize":291,"copy":305,"displayTitle":306,"subtitle":307,"hideTitleIfImageIsSet":11,"image":451,"iconName":284,"iconColour":303,"link":301,"linkText":284},{"url":309,"alt":310,"title":310,"width":299,"height":311,"format":300,"focalPoint":301,"customData":452},{},{"_modelApiKey":290,"cardStackSize":291,"copy":314,"displayTitle":315,"subtitle":316,"hideTitleIfImageIsSet":11,"image":454,"iconName":284,"iconColour":303,"link":301,"linkText":284},{"url":318,"alt":319,"title":319,"width":320,"height":320,"format":300,"focalPoint":301,"customData":455},{},{"_modelApiKey":283,"displayTitle":323,"titlePositioning":285,"titleTag":324,"subtitle":284,"copy":284,"columns":325,"cards":457,"cta":301,"ctaText":284,"darkTheme":11},[458,459,460,461],{"_modelApiKey":290,"cardStackSize":291,"copy":328,"displayTitle":329,"subtitle":284,"hideTitleIfImageIsSet":11,"image":301,"iconName":330,"iconColour":303,"link":301,"linkText":284},{"_modelApiKey":290,"cardStackSize":291,"copy":332,"displayTitle":333,"subtitle":284,"hideTitleIfImageIsSet":11,"image":301,"iconName":334,"iconColour":303,"link":301,"linkText":284},{"_modelApiKey":290,"cardStackSize":291,"copy":336,"displayTitle":337,"subtitle":284,"hideTitleIfImageIsSet":11,"image":301,"iconName":338,"iconColour":303,"link":301,"linkText":284},{"_modelApiKey":290,"cardStackSize":291,"copy":340,"displayTitle":341,"subtitle":284,"hideTitleIfImageIsSet":11,"image":301,"iconName":342,"iconColour":303,"link":301,"linkText":284},{"_modelApiKey":344,"title":345,"copy":346,"items":463},[464,467,470,473,476],{"title":465,"content":466},"Product security","\u003Ch4>Authentication\u003C\u002Fh4>\n\n\u003Cp>Commerce Layer utilizes the \u003Ca href=\"https:\u002F\u002Fdocs.commercelayer.io\u002Fcore\u002Fauthentication\">OAuth 2.0 protocol\u003C\u002Fa>, which is an industry-standard, to handle client authorization. All API requests require authentication. Access tokens can be obtained by executing an authorization flow using a valid application as the client. The specific authorization flow depends on the grant type. Access tokens have a lifespan of 2 hours, while refresh tokens expire after 2 weeks.\u003C\u002Fp>\n\n\u003Ch4>Roles management\u003C\u002Fh4>\n\n\u003Cp>Commerce Layer supports a granular access control system at the resource level. Each access token is assigned a specific set of \u003Ca href=\"https:\u002F\u002Fdocs.commercelayer.io\u002Fcore\u002Froles-and-permissions\">permissions\u003C\u002Fa>. The client and the authorization flow determine the allowed actions for each resource.\u003C\u002Fp>\n\n\u003Ch4>Vulnerability management\u003C\u002Fh4>\n\n\u003Cp>In addition to ongoing automated malicious dependency scanning and static code analysis, our services undergo \u003Cstrong>Penetration Testing\u003C\u002Fstrong> at least once a year. We also perform quarterly external vulnerability scans.\u003C\u002Fp>\n\n\u003Cp>Any detected vulnerability is evaluated to determine if it is truly impacting our security. If that is the case, it is immediately assigned to the appropriate team and addressed with a \u003Cstrong>Service Level Agreement (SLA)\u003C\u002Fstrong> based on its severity. All relevant vulnerabilities are addressed within \u003Cstrong>90 days\u003C\u002Fstrong> of discovery.\u003C\u002Fp>",{"title":468,"content":469},"Data security","\u003Ch4>Encryption\u003C\u002Fh4>\n\n\u003Ch5>In transit\u003C\u002Fh5>\n\n\u003Cp>Commerce Layer utilizes \u003Cstrong>TLS 1.2\u003C\u002Fstrong> or higher for all data transmission over potentially insecure networks. We also enforce security features like \u003Cstrong>HSTS (HTTP Strict Transport Security)\u003C\u002Fstrong> to enhance the security of our data during transit. Our cloud infrastructure providers handle the management and deployment of server TLS Keys and certificates at the origin, while our CDN provider handles them at the origin.\u003C\u002Fp>\n\n\u003Ch5>At rest\u003C\u002Fh5>\n\n\u003Cp>All datastores, including databases, caches, storage buckets and filesystems, are encrypted at rest using industry-standard algorithms implemented by our cloud providers.\u003C\u002Fp>\n\n\u003Cp>Encryption keys are managed using the providers' key management systems. Application secrets are encrypted and securely stored using the providers' secrets and parameters management tool. Access to these values is strictly limited.\u003C\u002Fp>\n\n\u003Ch4>Data retention and removal\u003C\u002Fh4>\n\n\u003Cp>All data is removed or anonymized as soon as possible after deletion or service cancellation. Users can also \u003Ca href=\"mailto:support@commercelayer.io\">contact us\u003C\u002Fa> to have their data removed.\u003C\u002Fp>",{"title":471,"content":472},"System security","\u003Ch4>System configuration\u003C\u002Fh4>\n\n\u003Cp>System configuration and consistency are maintained by using standard, up-to-date images and infrastructure-as-code tools. This is done by replacing systems with updated deployments.\u003C\u002Fp>\n\n\u003Cp>When systems are deployed, they utilize up-to-date images that have been updated with configuration changes and security updates. After deployment, existing systems are decommissioned and replaced with up-to-date systems.\u003C\u002Fp>\n\n\u003Ch4>Access management\u003C\u002Fh4>\n\n\u003Cp>Commerce Layer employees are only granted access to applications they need based on their role, and automatically deprovisioned upon termination of their employment. Employee computers are secured with encrypted hard drives and firewalls, and access to central resources and third-party services are always encrypted and protected with two-factor authentication. \u003C\u002Fp>\n\n\u003Cp>\u003Cstrong>Commerce Layer employees do not have physical access to data centers, nor access to the underlying cloud infrastructure.\u003C\u002Fstrong>\u003C\u002Fp>",{"title":474,"content":475},"Business continuity","\u003Cp>Commerce Layer's services are built using leading cloud infrastructure providers. These providers offer fully redundant and distributed systems that run across multiple regions and availability zones. This means that even if a single component fails, there will be no significant service disruptions. Regular maintenance is performed on components without affecting availability.\u003C\u002Fp>\n\n\u003Cp>The providers' load balancers and \u003Cstrong>Content Delivery Networks (CDNs)\u003C\u002Fstrong> are capable of mitigating various types of \u003Cstrong>Distributed Denial of Service (DDoS)\u003C\u002Fstrong> attacks. Additionally, our backend systems can automatically scale to handle increased load.\u003C\u002Fp>\n\n\u003Cp>In the event of a disaster, our services and processes are designed to enable recovery within a few hours, with minimal to no data loss.\u003C\u002Fp>",{"title":477,"content":478},"Corporate security","\u003Ch4>Employee screening and policies\u003C\u002Fh4>\n\n\u003Cp>All of our employees undergo relevant background checks and security training. Additionally, they are required to sign confidentiality agreements.\u003C\u002Fp>\n\n\u003Cp>Access to customer data is limited to a small group of employees based on the principle of least privilege, meaning they only have access if it is necessary for their work. Furthermore, all access is monitored through dedicated audit controls.\u003C\u002Fp>\n\n\u003Ch4>Secure development practices\u003C\u002Fh4>\n\n\u003Cp>Commerce Layer provides comprehensive security training to all employees during onboarding and annually. In addition, engineers are required to attend an annual training session specifically focused on secure coding principles and practices.\u003C\u002Fp>\n\n\u003Cp>As part of our \u003Cstrong>Secure Development Lifecycle\u003C\u002Fstrong>, we conduct code peer reviews prior to deployment. Additionally, we make use of \u003Cstrong>CI\u002FCD\u003C\u002Fstrong> tools to enable efficient and systematic development, testing, and deployment of our product. This approach ensures prompt and effective resolution of potential bugs and security issues, while minimizing the risk of human error.\u003C\u002Fp>",[],[],1790330007953]