How Sails protects your data
Last reviewed: September 25, 2026
Sails is a small company, so here's plainly what we do today — no badges or certifications we don't have.
Your store connection
- Sails only asks for read access: permission to read orders and store locations on Shopify, and a read-only API key on WooCommerce. Sails only ever reads — it never changes your orders, products or settings.
- The keys that let Sails read your store are encrypted with AES-256-GCM before they're saved, using a key kept outside the database.
- While a Shopify or WooCommerce store is connected, Sails checks it for new orders once a day and whenever you click Sync.
- Disconnecting a store deletes its saved keys straight away. Orders already imported stay in your account until you delete your account.
What Sails keeps — and what it doesn't
From each order, Sails keeps only what sales tax work needs: the order number and date, amounts, tax collected, status, the items sold (name, quantity, price and SKU), and the ship-to city, state, ZIP code and country.
Sails does not keep your buyers' names, email addresses, phone numbers or street addresses, even when your store platform sends them.
The free nexus check reads your files in your browser. They're never uploaded to Sails or anyone else.
Your account
- Passwords are stored only as bcrypt hashes, never in readable form.
- You stay signed in with a secure, HTTP-only cookie that expires after 7 days.
- Sign-in attempts are rate limited to slow down password guessing.
- Sails doesn't offer two-factor sign-in yet, so use a strong password you don't use anywhere else.
Infrastructure
- Every connection to Sails uses HTTPS, and browsers are told to always use it (HSTS). Pages also send standard security headers that block framing and content-type sniffing.
- Sails runs on Vercel, and its database is hosted by Neon, which encrypts stored data. Store keys get the extra layer of encryption described above.
- Error reports leave personal details out by default, and Sails doesn't record screens or sessions.
- Sails uses one cookie, to keep you signed in. There are no tracking or advertising cookies.
You're in control
- Download a copy of your data at any time, or delete your account and data permanently, in Settings → Data & Privacy.
- Turn alert, reminder and tip emails on or off in Settings → Notifications.
Service providers
Sails uses these companies to run the service. Each only gets what it needs:
| Provider | What it does | What it receives |
|---|---|---|
| Vercel | Website and application hosting | Everything the app handles passes through it; request logs are kept for a limited time. |
| Neon | Database hosting | Your account, business details, imported orders and filing records. |
| Stripe | Subscription billing and payments | Your email and billing details. Card numbers go straight to Stripe; Sails never sees them. |
| Resend | Sending account emails and the alerts you've turned on | Your email address and the content of the email. |
| Sentry | Error monitoring | Technical details about errors. Personal details are left out by default. |
| Upstash | Rate limiting | Sign-in email addresses, IP addresses or account IDs, kept briefly to count requests. |
| TaxJar | Tax rate lookups for some calculations | The destination address and amount of the sale being calculated. |
Your store platform (for example Shopify or WooCommerce) is where the orders come from. Sails reads from it only after you connect your store, and stops when you disconnect it.
Found a problem?
If you think you've found a security issue, please email support@sails.tax with the details. A person reads every message, and we'll reply as soon as we can. See also our privacy policy.