Security & AI Transparency

Commerce Brain™ is a reasoning engine. It reads signals from your connected Shopify store, cross-references them against your Decision Memory (private layer), and produces ranked decisions with the evidence behind them.

• It never invents financial numbers, KPIs, or historical facts.
• It never executes financially material actions without human approval.
• It never blends your Decision Memory (private layer) with another business's data.
• It never trains third-party foundation models on your identifiable business data.

• Industry-standard password hashing (bcrypt).
• Optional two-factor authentication with an authenticator app (TOTP).
• Session revocation on password reset and suspicious login.

Every action OCCEAN takes in your store is recorded with the actor, the timestamp, the target it touched and the outcome — including failures. An undo is written as a new entry rather than removing the original, so the sequence of what happened stays readable.

A workspace has four roles: Owner, Executive, Analyst and Viewer. Owner and Executive boundaries are enforced in the database itself, through row-level security that checks organization ownership and membership, so they hold even if a request bypasses the interface. The distinction between Analyst and Viewer is presentational today — both see the same workspace data, and we are moving those checks into the database next. Enterprise: contact us for custom security requirements.

Confirmed incidents affecting customer data are investigated promptly and affected customers are notified without undue delay.

Report vulnerabilities responsibly to success@occean.app. We aim to acknowledge reports promptly and coordinate disclosure with researchers.