Team & account
Data, security and backups
BunStack as data processor, the sub-processors, the backups and what the Settings › Security tab does.
Where: Settings › Security. The agreement is section 05 of the pilot terms.
BunStack as data processor
You are the data controller for the data in the storefront: customers, orders, returns and messages. BunStack is your data processor. During the pilot, section 05 of the pilot terms is the data processing agreement.
BunStack uses these sub-processors and no others:
| Sub-processor | Does | Location or transfer |
|---|---|---|
| Supabase | Database, sign-in, file storage and server functions | AWS Stockholm (eu-north-1). US company. EU standard contractual clauses |
| Vercel | Runs the admin, the storefronts and the designer | Server code in Stockholm (arn1). Static files on a global network. US company. EU standard contractual clauses |
| Resend | Sends order confirmations and the platform's other emails | US company. EU standard contractual clauses |
| Sentry | Receives error reports when error reporting is on | US company. EU standard contractual clauses |
| Google Workspace | The support@bunstack.co mailbox | May process outside the EU. EU standard contractual clauses |
The details are in the privacy notice. You connect Kustom, Sendify, PostNord and ProSmart yourself. They get the data under your own agreement with them and are not BunStack's sub-processors.
Export and erasure of a customer's data are under Export and erasure (GDPR).
Backups
- BunStack backs up the database once a day, around 03:00 UTC.
- BunStack keeps the backups for about a week.
- There is no continuous backup. A restore can lose up to a day's changes.
- A restore applies to the whole platform, not to a single storefront.
- The backups do not include uploaded files: product images, images in the designer and return labels.
Keep your own copy with Export CSV under Orders, Customers and Products › ⋯. The limits are under Reports.
Warning: The backup contains no uploaded files. BunStack cannot restore a lost image. Keep the originals of the images yourself.
Settings › Security
The Security policy card saves five settings with Save policy. None of them is applied yet. The top of the card says Nothing here is enforced yet — BunStack stores it for when it is. and lists what you have turned on.
| Setting | Status |
|---|---|
| Require two-factor for all members | Saved, not applied |
| Require PIN for sensitive actions | Saved, not applied |
| Preferred sign-out window | Saved, not applied. You stay signed in for 30 days per device |
| Activity log digest email | Saved, no email is sent. Read Activity log in the admin |
| IP allowlist (CIDRs, one per line) | Saved, not applied |
Sign out every device with Sign out everywhere. See Sign-in and password.