Guides

Security and data processing

What happens to keys, the KSeF certificate and buyer data when you use the API.

Keys and transport

• The whole API is HTTPS only.
• We store API keys only as SHA-256 hashes. You see the full key once, when it is created, and can roll it at any time.
• Test and live data are separate: a test key sees no live invoices and vice versa.
• Webhooks are signed with HMAC-SHA256 using each endpoint's own secret. Verifying signatures

KSeF certificate and token

The seller's KSeF certificate (or token) is used only to send that seller's invoices to KSeF. We store it encrypted and never show it back in the API or the panel. If you revoke the certificate in KSeF, sending stops at once and invoices get ksef_auth_failed.

What data we receive

Only what the invoice needs: the buyer's NIP, name and address, order lines, amounts and, optionally, the buyer's email (we send the PDF there). Send only orders with a NIP; the WooCommerce plugin does so by itself and passes no IP address, user agent, phone or customer id.

The pdf_url link is public and contains an unguessable token. Treat it like the document itself: share it only with the buyer.

Infrastructure

The API runs on the same infrastructure with the same safeguards as the KSeF Faktury app: EU servers, encrypted orders, XML and PDF files and backups. Details: Security.

Roles and documents

The seller is the controller of its buyers' data; we process it on the seller's behalf to issue and send invoices. The current legal documents (privacy policy) describe the Shopify app. A data processing agreement and terms for API customers will be ready before live mode is enabled.

Reporting vulnerabilities

If you find a security issue, write to kontakt@ksefshop.pl with the subject "Security". Please do not test against other people's accounts or data.