Data and security FAQ

Is my store's data separate from other stores?#

Yes. Every store has its own database with its own credentials that reach nothing else. File storage, cache and background jobs are separated the same way.

Are there backups?#

Yes. Each store's database is backed up every night; daily copies are kept for 14 days and weekly copies for three months. A store can be restored on its own from a support request.

Where is card data stored?#

Nowhere on Kambloo. Card details are entered in the payment provider's own secure form and only a token comes back to your store. This keeps the store within the PCI SAQ-A scope.

Do I have to use two-factor authentication?#

It is strongly recommended for every account and required before a store can go live. See Signing in and account security.

Who can access my store?#

Only the staff you invite, with the role you give them, and Kambloo support when you ask for help. Support access is logged.

Can I export my data?#

Yes. Owners can export the whole store as a ZIP from the settings; customers can download their own data from their account. See Customers and consent.

What happens to my data when I delete the store?#

After a 30-day window the database is dropped, files are purged and domains are released. Copies in backups expire with the retention cycle. See Cancelling and deleting a store.

Are security fixes installed automatically?#

Yes. Security releases are applied to every store shortly after they are announced; they cannot be postponed. See Platform updates.