Technical data and security — no fog.
What is built, what the limits are and what is not decided yet. If something is not on this page, we do not promise it.
Sign-in and access
| Two-factor sign-in | Authenticator-app codes (TOTP) and 10 single-use recovery codes. Secrets are stored encrypted (AES-256-GCM). Optional for each user. |
|---|---|
| Passwords | At least 15 characters; stored only as a scrypt hash. |
| Sign-in protection | Sign-in attempts are limited per e-mail and per installation. |
| Sessions | Admin sessions last up to 8 hours, in a protected cookie (HttpOnly, SameSite). |
| Roles | Owner, staff and custom roles with separate permissions (catalogue, orders, stock, settings).Partial |
| Change history | Immutable history for roles, passwords, two-factor sign-in, staff and consents. |
Orders and stock
| Double-order protection | A repeated or double click returns the same order instead of creating a second one. |
|---|---|
| Stock reservation | Reservation, order and stock movement are written in one transaction. |
| Warehouses | Up to 20 warehouses per store technically; your plan sets how many are included (1/3/10). |
Catalogue — technical limits
| Variants | Up to 100 variants and 3 options (20 values each) per product. |
|---|---|
| Images and attributes | Up to 12 media files and 30 attributes per product; up to 10 MB per file. |
| CSV import | Up to 500 rows and 256 KB per file, with a row-by-row result. Larger catalogues are imported in parts. |
Storefront and SEO
| URLs and sitemap | sitemap.xml, robots.txt, canonical URLs and custom 308 redirects. |
|---|---|
| Structured data | schema.org Product and BreadcrumbList for indexable stores. |
| Content Security Policy | A CSP with a one-time key per page; the admin cannot be embedded in another site. |
| Storefront speed | Optimised product images. Measuring Core Web Vitals on a live domain is still to come.Partial |
Data and personal data
| Visit measurement | Only after consent; no cookie and no IP address before consent. |
|---|---|
| Marketing consents | Recorded with version, withdrawal, history and export. |
| Card data | Targovio never stores card data. Card payments will go through a licensed provider.Planned |
| Data export | Products, stock, orders and sales as CSV. |
| Full export and deletion of a customer account | In the plan before launch.Planned |
Infrastructure
| Technology | Next.js 16, React 19, TypeScript, PostgreSQL 17 with data isolated per store. |
|---|---|
| Automated tests | More than 1,600 automated checks and browser tests guard every change. |
| Production hosting | To be chosen before launch. We will publish the provider and where data is stored.Planned |
| Backups | A backup tool and a restore test exist; the schedule and copies outside the main provider are set before launch.Partial |
| Monitoring and SLA | Monitoring and alerts are set up before launch. We do not promise an uptime percentage until we measure it.Planned |
| Public API and webhooks | Planned.Planned |
Checked against Targovio’s code and documentation as of 7 October 2026.
Frequently asked questions
Where is the data stored?
Production hosting is chosen before launch. We will name it here and in the contract — we do not promise a location that has not been chosen yet.
What uptime do you guarantee?
No percentage yet — we cannot promise a number we do not measure. Monitoring and alerts are set up before launch; we will publish a target then.
Can I download my data?
Yes — products, stock, orders and sales as CSV. Your data is yours.
Want to be one of the first stores?
Tell us about your store. We will show you Targovio live and tell you honestly what is ready for you and what is not yet.