How Pilotafrik protects your data

Access to the dashboard requires an authenticated account. Store members (Manager, Closer, Courier) are created by the manager; closers sign in with their email and a password chosen at activation.

Repeated PIN validation or sign-in attempts are rate limited (5 attempts per 15-minute window) to reduce brute-force attacks.

Each role has a strictly bounded scope enforced server-side: a Closer only sees orders for the country they have been assigned, and can only change an order's app status. Only the Manager can manage the store, the team, finances and integrations.

Pilotafrik is built on secure Supabase infrastructure. The database, authentication and server functions run behind row-level security (RLS) rules that filter every query by the signed-in user and their role.

Communications between your browser and the platform are encrypted in transit over HTTPS/TLS.

Pilotafrik processes the data required to run an e-commerce store: Shopify orders imported via webhook (number, amount, customer, address, product), team members (email, role, assigned country) and store settings. Shopify API tokens are stored server-side only and are never exposed to the browser.

The platform integrates with Shopify (order import via HMAC-signed webhooks), Telegram and CallMeBot (new-order notifications to the teams), and Supabase for application hosting and the database.

Orders and store data are retained for as long as the Pilotafrik account is active. Deactivating a team member immediately cuts off their access to all data. To request account deletion or an export, contact support below.

If you believe you have found a vulnerability, contact the Pilotafrik team on WhatsApp at +229 67 92 79 08 with a description of the issue and the steps to reproduce it. Please do not publicly disclose the issue before it is fixed.