Security

Ongoing is built on public ecommerce signals, production-grade infrastructure, and clear operational controls. We design our systems to protect customer accounts, organization settings, billing relationships, API access, and the infrastructure that powers our Shopify ecosystem data.

Most of the data Ongoing indexes is public storefront, app, technology, and ecosystem data. The most sensitive information we protect is the private data associated with your account: authentication, billing, organization membership, API keys, saved configuration, and product usage.

We do not overstate our security posture. This page describes the controls currently in place, the platforms we rely on, and the areas where formal certifications are still on the roadmap.

Ongoing runs on managed infrastructure providers with production security baselines, isolation, backups, and operational monitoring.

• Application — Google Cloud Platform (Cloud Run jobs and services) for collection, detection, and enrichment workloads.
• Marketing site and dashboard — Vercel for hosting and edge delivery.
• Database — Google Cloud SQL for Postgres with automated backups and point-in-time recovery.
• Object storage — Google Cloud Storage for raw collection artifacts; Cloudflare R2 for published public data.
• Sibling services — isolated microservices for collection, detection, and enrichment. Cross-service access requires authenticated secrets and is never anonymous.

We separate customer-facing application infrastructure from collection and enrichment services where practical, reducing unnecessary exposure between systems.

• In transit. TLS 1.2+ is required on public surfaces, including the marketing site, dashboard, API, and MCP server.
• At rest. Managed database storage and object storage use platform-provided encryption at rest.
• Secrets. Application secrets, API keys, and cross-service tokens are stored in managed platform secret stores and are not committed to source control.
• Payments. Payments and subscriptions are processed by Stripe. Ongoing does not see or store full card numbers.
• Authentication. Account authentication is handled by Clerk. Passwords are hashed using a modern adaptive hashing algorithm and are never stored in plain text.
• Data minimization. Ongoing’s product is designed around public ecommerce and technology signals. We avoid collecting private merchant, customer, or shopper data unless it is required to operate the service.

• Least privilege. Production access is limited to authorized personnel and scoped to the systems required for operational work.
• Multi-factor authentication. MFA is enforced on critical production platforms, including cloud providers, payment systems, and source control.
• Organization scoping. Ongoing accounts authenticate users. Organizations own subscriptions, data access, configuration, and membership permissions.
• API keys. API keys are scoped to an organization and can be revoked individually.
• Service-to-service access. Internal services authenticate with scoped secrets. Anonymous cross-service access is not permitted.

Ongoing logs application requests, queue activity, job failures, authentication events, and production errors. Error tracking and uptime monitoring run continuously, with notifications for production regressions and operational failures.

Logs and telemetry are retained on a rolling window measured in months. This retention period is designed to support investigation, debugging, abuse prevention, and incident response while limiting unnecessary long-term exposure.

The vendors below are part of how Ongoing delivers the Service. Where applicable, they process data under their respective data-processing terms, security terms, or service agreements. We select infrastructure and operational vendors based on reliability, security maturity, and suitability for production workloads.

• Stripe — payments and subscriptions.
• Vercel — marketing-site hosting and edge delivery.
• Google Cloud Platform — application infrastructure, scheduled jobs, managed Postgres, and object storage.
• Cloudflare — DNS, content delivery, and object storage for published data.
• Clerk — account authentication and user management.
• Google Analytics — aggregate traffic measurement on the marketing site.
• Sentry — error tracking and production incident notification.
• Anthropic and OpenAI — model providers used to enrich, classify, and summarize dataset inputs.

Ongoing is not currently SOC 2, ISO 27001, or HIPAA certified.

We do not claim certifications, attestations, or regulatory coverage that we do not hold. Instead, we publish our current controls, describe our vendors, and maintain a practical security program appropriate for the product and the data we process.

As customer requirements evolve, we expect to pursue formal security attestations where they create meaningful value for customers and improve our internal operating discipline.

For data-protection roles, privacy choices, and data-handling details, see our Privacy Policy. For terms governing access to and use of the Service, see our Terms of Service and Acceptable Use Policy.

If you believe you’ve found a security vulnerability in Ongoing, please email security@ongoing.ai with a description and reproduction steps. We’ll acknowledge receipt within two business days.

We ask that you:

• Give us a reasonable window to triage and fix the issue before public disclosure.
• Avoid accessing data that is not yours.
• Avoid modifying production data.
• Avoid denial-of-service testing.
• Use the vulnerability only to verify and responsibly report the issue.

Ongoing does not currently operate a paid bug bounty program, but we appreciate good-faith security research and credit researchers who report issues responsibly.

Security questions: security@ongoing.ai

Legal or privacy questions: legal@ongoing.ai

General inquiries: use the contact page.