Skip to navigation
DocsStorefrontCatalystReference

Privacy and Security

Catalyst’s privacy and security come from three places: the certifications of the BigCommerce platform it runs on, the security practices built into Catalyst itself, and the Next.js framework. This page covers each.

BigCommerce certifications

By default, all commerce operations and checkout use BigCommerce’s GraphQL APIs and hosted checkout, which are covered by the following data privacy and security certifications:

  • CCPA
  • CSA STAR
  • EU-US DPF
  • FIPS 140-2
  • GDPR
  • ISO 22301
  • ISO 27001 SoA
  • ISO 27001:2022
  • ISO 27017
  • ISO 27018
  • ISO 27701
  • PCI DSS
  • Privacy Shield
  • RH-ISAC
  • SOC 1, SOC 2, SOC 3
  • TX-RAMP
  • Visa Service Provider

You can learn more about these certifications and request a security review at security.bigcommerce.com.

Security vulnerability monitoring

Catalyst is part of BigCommerce’s bug bounty program. The BigCommerce security team monitors and responds to reports, and also scans and reviews the codebase internally. For details, see SECURITY.md in the Catalyst repository.

Best practices implemented

Limited data access

By default, Catalyst uses only the GraphQL Storefront API, which has no access to admin functionality. It’s scoped to the storefront and to anonymous or signed-in shoppers.

Content Security Policy (CSP)

Catalyst sends a Content Security Policy (CSP) header on every response, which you can extend to meet your organization’s specific security standards. A CSP lets you specify the sources of content that are allowed to load on your site, which helps to prevent Cross-Site Scripting (XSS) and data injection attacks.

The default policy is deliberately minimal. It sets only two directives:

  • base-uri 'self'
  • frame-ancestors, set to 'none' so other sites can’t embed your storefront in a frame. When MAKESWIFT_SITE_API_KEY is set, it allows the Makeswift editor origin instead (MAKESWIFT_BASE_URL, defaulting to https://app.makeswift.com), so the visual editor can load your storefront.

Every other directive (default-src, script-src, img-src, and so on) is included but commented out, ready for you to enable. Customize the policy in lib/content-security-policy.ts. The header itself is applied in the headers() function in next.config.ts.

Catalyst includes a built-in cookie consent manager powered by c15t. It displays a consent banner to shoppers, respects their preferences by controlling which scripts load, and stores consent decisions locally in the shopper’s browser. Cookie consent support is available in Catalyst v1.3.0 and later.

Catalyst cookie consent banner

For full details on default cookies, consent categories, configuration options, and connecting to a backend consent service, see the Cookie Consent guide.

Framework benefits

Next.js security record

Next.js has hundreds of active contributors and a consistently high package health score from Snyk.

Industry adoption

Next.js is used by companies that handle millions of users and sensitive data in sectors including commerce, ticketing, and media. For examples, see the Next.js showcase.