Control stays with your shop.

Infrastructure and transport

• Primary application and Commerce MCP workloads run in DigitalOcean’s FRA1 region in Frankfurt, Germany.
• Network traffic to the service is protected using HTTPS/TLS. Production services and databases are separated from public application entry points as appropriate.
• Passwords are stored as one-way hashes. Application secrets and connection credentials are encrypted or held in protected runtime configuration and are not displayed back to users.

Shopware access

• A short-lived pairing flow links the exact Shopware installation to an authenticated 50lution account.
• Access is scoped to the capabilities reported by the installed Commerce Assistant plugin. New Commerce MCP functions are not exposed to a shop that has not reported the required capability.
• Read and write functions are separated. Sensitive operations use previews or explicit confirmation where the operation supports a material change.
• Connections can be disconnected, and temporary provisioning credentials are not used as permanent shop credentials.

Data path and minimisation

Commerce MCP receives the parameters required for an authorised tool call, requests the relevant information from the connected Shopware installation, and returns the result to the initiating AI workspace. We design tools to request only the fields and scope needed for the operation.

The user’s AI provider is outside 50lution’s infrastructure. Its handling of prompts, conversation history and tool results depends on the user’s plan, settings and agreement with that provider.

Billing and email

• Paddle provides hosted checkout and subscription management. 50lution stores billing status and provider identifiers, not complete payment-card details.
• Transactional messages are sent through a configured email provider. Messages contain only the account or service information needed for their purpose.

Operational safeguards

• Authenticated access, request validation, rate limits and ownership checks protect account and connection actions.
• Operational and security events may be logged to investigate errors, abuse and incidents; secrets are excluded or redacted where designed.
• Access by 50lution personnel is limited to authorised operational and support needs and is subject to confidentiality obligations.
• Dependencies and integration capabilities are maintained and tested as part of the release process. We do not claim a security certification that has not been independently obtained.

Your responsibilities

• Protect your 50lution account and AI workspace with strong, unique credentials and multi-factor authentication where the provider offers it.
• Give access only to authorised staff, review requested operations before confirmation and disconnect integrations that are no longer used.
• Configure Shopware permissions, retention and customer notices according to your organisation’s legal requirements.
• Do not place secrets or unnecessary sensitive personal data in prompts or support messages.

Report a security issue

Report suspected vulnerabilities, unauthorised access or data incidents to [email protected]. Include a clear description and reproduction details, but do not include personal data or exploit a vulnerability beyond what is necessary to demonstrate it. We will acknowledge and investigate credible reports.