Security at Shelfly
We take the security of your data, payments, and account seriously. Here's a transparent overview of the technical measures that protect you when using Shelfly.
Last updated: January 2026
HTTPS and TLS Encryption
All traffic between your browser and Shelfly is encrypted using HTTPS, secured by TLS (Transport Layer Security). This means every page load, login, booking request, and message you send travels over an encrypted connection that protects your data from interception. TLS certificates are issued and renewed automatically — you'll always see the padlock icon in your browser's address bar.
Authentication via OpenID Connect
Shelfly uses OpenID Connect (OIDC) for user authentication — the same standard used by Google, Microsoft, and thousands of enterprise applications. You sign in through a trusted identity provider, which means Shelfly never sees or stores your password. Your login session is encrypted and managed server-side with a securely generated session key.
Payment Security (PCI DSS Compliant)
All payment processing is handled by Stripe, a PCI DSS Level 1 certified provider — the highest level of payment security certification available. Card details are entered directly into Stripe's secure card input, transmitted directly to Stripe's servers, and tokenized before processing. Shelfly's servers never receive, process, or store your full card number, CVV, or banking information.
Data Storage and Access Controls
Shelfly stores only the data needed to operate the platform: your account information (name, email, profile photo from your identity provider), booking details, and store/space listings. Your data is stored in a secure, encrypted PostgreSQL database. Access to production data is restricted to authorized systems only — no individual can browse raw user data without a documented reason.
No Passwords Stored
Because Shelfly uses a third-party identity provider for authentication, we never store your password — not in plain text, not hashed, not at all. There is no password to steal, forget, or reset through Shelfly. This eliminates one of the most common sources of account compromise.
Reporting a Security Issue
If you discover a potential security vulnerability on Shelfly, please report it to us immediately so we can investigate and address it. Do not disclose potential security issues publicly until we've had a chance to evaluate and respond.
Contact: security@shelfly.biz