You're handing us keys to your shop.
Here's exactly what we do with them.
Connecting a tool to your store should not feel like a leap of faith. This page describes, concretely, what Vario stores, what it can reach inside your store, and what it cannot.
No marketing words like “bank-grade” or “military-grade” – just the actual mechanics.
Credentials are encrypted at rest
Your WooCommerce consumer key and secret are encrypted with AES-256-GCM – an authenticated cipher, so tampering with the stored value is detected – before they ever reach the database.
The encryption key lives in the application environment, not in the database. A stolen database dump on its own does not hand anyone your store.
We never see your WordPress password
The one-click connect flow sends you to your own store's authorisation screen. You approve the request while logged in as yourself, and WooCommerce generates the API key and hands it back to Vario.
Your WordPress username and password are typed into your own site, never into Vario. We never receive them, and we could not use them if we did.
We only call your store when you act
Vario contacts your store in exactly two situations: when you run a sync to pull variations in, and when you save to push your edits back.
There is no background polling, no crawler, no traffic to your store while you are asleep. Saves use the WooCommerce batch endpoint, so a hundred edits are one request, not a hundred.
HTTPS, and public stores only
Vario connects only to publicly reachable stores over HTTPS. Credentials and product data are never sent over plain HTTP.
If your store sits behind a VPN, a staging password, or is only reachable on a private network, Vario cannot reach it – by design, so the connection can never be silently downgraded.
What Vario can and cannot do
Vario requests read/write scope on products – that is the permission WooCommerce grants for the products and variations endpoints, and it is what the spreadsheet needs in order to show your variations and save your edits. In practice that means:
Vario can
- Read your products and their variations
- Read variation attributes and SKUs
- Update price and sale price
- Update SKU
- Update stock quantity and stock status
Vario cannot
- Read your customers
- Read or change your orders
- Take payments or issue refunds
- Install, change or remove themes and plugins
- Log in to your WordPress admin
- Create or delete users
One honest caveat: an API key with products scope is a products key, not a “price and stock only” key – WooCommerce does not offer a narrower permission than that. Vario's interface only ever writes the fields listed above, and every pending change is highlighted before you save it.
Your Vario account
Passwords are hashed with bcrypt
We store a bcrypt hash of your password, never the password itself. Nobody at Vario can read it, and a database leak would not reveal it. If you reset your password, we replace the hash – we cannot email you your old one, because we do not have it.
Credentials are never shown again
Once a store is connected, the consumer key and secret are write-only from your point of view. Settings shows the store and the connection status, not the secret. There is no “reveal” button, because there is no safe way to have one.
Payments never touch our servers
Subscriptions are handled by Polar. Card details go straight to Polar and its payment partners – Vario never sees or stores a card number.
You can cut us off at any time
- Disconnect in Vario. Open Settings and disconnect the store. The encrypted credentials and all cached product data for that store are deleted immediately.
- Delete the key in WooCommerce. Go to WooCommerce → Settings → Advanced → REST API and revoke the key named for Vario. This is the authoritative kill switch – once revoked, the key is dead even if it existed anywhere else.
- Or delete your account. Deleting your Vario account removes your account record, every store connection, every set of encrypted credentials, and all cached product and variation data.
Disconnecting or deleting never changes anything in your store. Your products, prices and stock stay exactly as they were at the last save.
Reporting a vulnerability
If you have found a security issue in Vario, please tell us before you tell anyone else. Email info@getwebbed.dk with steps to reproduce, and any proof-of-concept you have.
- We aim to acknowledge reports within 2 business days.
- We will keep you updated while we investigate and fix.
- We will credit you when the fix ships, if you would like us to.
Please do not run automated scanners against production, access data that is not yours, or degrade the service for other users while testing. Report in good faith and we will respond in good faith.