West Europe (Netherlands), with backups in North Europe (Ireland).
Multi-factor authentication, with lockout after three failed attempts.
Every year, and whenever the platform changes materially.
Also working towards Cyber Essentials. Part of Royal Mail Group.
StoreFeeder runs the orders, stock and customer data that your business depends on, so we treat its security as part of the product. StoreFeeder is part of Royal Mail Group. This page explains where your data is held, how it is protected and how we meet our data protection obligations.
Where your data is hosted
StoreFeeder is hosted on Microsoft Azure. Your data is held in Azure's West Europe region (Netherlands), with backups in the North Europe region (Ireland), so it stays within the European Economic Area.
ISO 27001 and Cyber Essentials
We are working towards ISO 27001 certification, the international standard for information security management. Our external certification audit is scheduled for November 2026, and we will update this page once certification is confirmed.
We are also working towards Cyber Essentials, the UK government-backed scheme that protects organisations against the most common cyber attacks.
Encryption
- In transit: all traffic to and from StoreFeeder is encrypted over HTTPS.
- At rest: stored data is encrypted using 256-bit AES through Azure Storage Service Encryption.
Access control
- Access to personal data is limited to the StoreFeeder staff who need it to provide the service, following the principle of least privilege.
- Everyone authorised to process personal data is bound by confidentiality obligations.
- Each customer account has a nominated Account Owner, so important account and billing changes go to one responsible person.
Login protection
- Multi-factor authentication: MFA is enforced, so a password alone is not enough to sign in.
- Account lockout: accounts are locked after three failed login attempts, which blocks password-guessing attacks.
Penetration testing
StoreFeeder is penetration tested every year, and again whenever there is a material change to the platform.
Data protection and GDPR
For the order and customer data you manage in StoreFeeder, you are the data controller and StoreFeeder acts as your data processor. Our customer terms and conditions (clause 11) set out our processor obligations, including:
- processing personal data only on your documented instructions;
- engaging sub-processors only with your authorisation and on equivalent terms;
- notifying you without undue delay of any personal data breach affecting your data;
- helping you respond to data subject requests and supporting audits;
- deleting or returning your personal data when the contract ends.
How we handle personal data collected through this website is covered in our privacy policy.
Security questions
If you need to complete a security questionnaire or due diligence review before choosing StoreFeeder, or want to report a security concern, please contact us and the team will help.
