Security is built into every part of Tocler. This overview explains the main protections; it is not a guarantee, and we keep improving them.

Accounts and access

• Passwords are hashed; repeated wrong attempts lock sign-in temporarily.
• 2-step login (authenticator app + one-time backup codes) for store owners and team members; store owners can require it for their team. Tocler staff always use 2-step login.
• Every team member has their own login and a role; the server checks every request against it.
• Changing a password or 2-step login signs out every other device. An activity log records who changed what.

Payments

• Card payments go to the store owner's own payment provider; Tocler never sees full card numbers.
• Every payment is confirmed directly with the payment provider (amount and currency checked) and each order is completed exactly once.
• Money held by Tocler (crypto through Tocler) is credited only from confirmed payments, held for a short period before payout, and paid only to addresses confirmed by email after a waiting period.

Your data and keys

• Product keys and codes, payout addresses, 2-step secrets and payment credentials are encrypted at rest.
• Stores are isolated from each other; customer emails and keys are masked in the Dashboard and only revealed through logged actions.
• All traffic uses HTTPS.

Keeping illegal goods out

Products are screened for prohibited items when created or edited, sales patterns are monitored, risky products are held for review, and every store has a "Report abuse / DMCA" link. See the Acceptable Use Policy and the AML & Compliance Notice.

Protection against abuse

Bot protection (CAPTCHA), rate limits, IP protection rules per store, and monitoring.

Tocler staff

Staff access is role-based and logged. Support can only open a read-only, time-limited view of a Dashboard, with a written reason.

Report a problem

Security issues: support@tocler.com. Please do not access other people's data or disrupt the Service while testing.