How we protect accounts, payments and data
This page says what we do to protect accounts, payments and data, and what we do not promise. It covers Ultineo E-commerce, Ultineo SaaS and this website. Ultineo Reasoning will be added when its application opens to customers.
Who operates the service and where it runs
Ultineo is operated by EGOLEAP INTERNATIONAL LTD., company number 2289501, established in Hong Kong. The same company operates Ultineo E-commerce and Ultineo SaaS.
For Ultineo E-commerce and this website, our published hosting arrangement is OVHcloud in London, United Kingdom. Support access and connected providers may involve processing in other countries. Text, images or other content selected for an AI or translation task, together with the instructions needed for that task, may be sent to the relevant service provider.
Ultineo SaaS infrastructure uses OVHcloud. A project's hosting region depends on the environment and hosting configuration selected for that project. Service providers or project connections may operate in other countries, and we do not represent that selecting a hosting region prevents all access from another country.
- Payments and cards
For a shop's own buyers, card or wallet details are handled by the connected payment provider. Ultineo keeps the transaction references, amounts and statuses needed to operate the shop, rather than full card credentials.
- Encrypted connections
Our website, the applications and the help centers answer on an encrypted connection, and a plain request is redirected to it. Browsers are told to keep using the encrypted address.
- Protected sign-in sessions
In the applications, session cookies travel only over an encrypted connection, are hidden from scripts and are not sent with requests coming from another site. Our pages refuse to be displayed inside a frame on another page.
- Team access
A project administrator invites each member by e-mail and can remove a member, who then loses access to the project immediately. From the profile, each member sees the devices signed in to the account, can end a session, and can verify an e-mail address and a phone number.
- API keys
A key is created by a project administrator, and its full value is shown once and cannot be shown again. A key belongs to one shop, can be restricted per resource to read or to read and write, and expires after 30, 90 or 365 days, or never, as chosen when it is created.
- Cookies and audience
On this website, optional scripts are held until you accept their category, and refusing it keeps them inactive. Visits are counted by a first-party request that sets no audience cookie and respects the Do Not Track and Global Privacy Control signals of your browser.
How we watch the service
Since 12 November 2026 an automated check requests our website, the sign-in pages and our shop every five minutes. It runs on our own hosting account.
Our servers receive security updates automatically and are checked every day.
What we do not promise
No system can promise absolute security.
The general terms of Ultineo E-commerce promise no uninterrupted availability: internet access, maintenance, external providers and technical incidents can interrupt or limit the service.
The terms of Ultineo SaaS do not promise uninterrupted service either: any agreed availability, backup, recovery or support commitment is set out in the applicable project agreement.
Closing access is not an automatic promise of immediate erasure from operational records, legal archives and backups.
When your processing requires a separate data-processing agreement or international-transfer safeguards, contact us to put the applicable terms in place before starting that processing.
Our main providers are listed on the Partners page. Contact us for the full list of recipients and their locations.
Report a security problem
Write to us through the contact page with the subject "Security", or at the e-mail address published on our legal pages. Say which page or account is concerned and what you saw, and never send a password.
Ask us a security question
Write to us from the contact page and put "Security" in the subject.
Questions about security
For Ultineo E-commerce and this website, our published hosting arrangement is OVHcloud in London, United Kingdom. The operator is established in Hong Kong, and support access and connected providers may involve processing in other countries. For Ultineo SaaS, a project's hosting region depends on the environment and hosting configuration selected for that project.
In your team, the people a project administrator has invited. On our side, access is limited to authorized staff and providers needing the information for their work: hosting and technical operations, security and verification, e-mail and SMS delivery, AI and translation, payment processing and delivery services, as applicable. The privacy policy of each product gives its own list.
Not full card credentials. For a shop's own buyers, card or wallet details are handled by the connected payment provider, and Ultineo keeps the transaction references, amounts and statuses needed to operate the shop. For Ultineo SaaS, when a payment service is used, payment information is handled through that service's payment flow.
Only a project administrator creates, disables or deletes a key. Its full value is shown once, when the key is created, and cannot be shown again: if you lose it, you delete the key and create another. A disabled or expired key is refused.
Where the EU or UK GDPR applies, we rely on the following grounds as appropriate: steps requested before a contract and performance of the service, legitimate interests, legal obligations, and consent. We also apply Hong Kong's Personal Data (Privacy) Ordinance where relevant. The privacy policy of each product gives the details.
Ask us to arrange closure, export or deletion rather than assuming that simply ceasing to sign in deletes the data. Closing access is not an automatic promise of immediate erasure from operational records, legal archives and backups. For data held on a merchant's behalf, these requests take account of the merchant's instructions, its own legal obligations and any applicable processing agreement.
No. We maintain the service and its security, but internet access, maintenance, external providers and technical incidents can interrupt or limit it. No uninterrupted availability is promised by the general terms of either product. Any separately agreed service commitment continues to apply.
Through the contact page, with the subject "Security", or at the e-mail address published on our legal pages. Say which page or account is concerned and what you saw. Never send a password.