Platforms such as Salla and Zid let a merchant in the Kingdom open a professional store in days, with payments, shipping and a storefront handled for them. Along with that convenience comes a common misunderstanding: that the platform takes care of all the security.

In reality the platform secures its own infrastructure. Your store's accounts, staff access, connected apps, domain, email and customer relationships are yours to protect. Most attacks on online stores target exactly those pieces, because they are easier than breaking the platform itself.

The ten steps below are written for store owners and managers rather than security specialists.

What the platform protects, and what you protect #

Think of it as a shared arrangement:

  • The platform looks after its servers, the core store software, its checkout and the payment integrations it provides.
  • You look after who can log in to your dashboard, what each person can do, which apps you connect, your domain name and email, your social media accounts, the data you export, and how you respond when something goes wrong.

The National Cybersecurity Authority, together with the Saudi e-Commerce Council, published Cybersecurity Guidelines for e-Commerce: one document for service providers, including small and home-based sellers, and one for consumers. The steps below follow the same spirit and turn it into a checklist.

Ten practical steps #

1. Lock down the owner account #

The owner account can change bank details, delete products and hand control to someone else. Use a unique, long password stored in a password manager, and turn on two-step verification wherever the platform, your email and your phone number support it. Never share the owner login.

2. Give every staff member their own account #

Shared logins make it impossible to know who did what. Create a separate account for each employee or agency, give each one only the permissions their job needs, and remove access the same day someone leaves or a contract ends.

3. Be careful with apps and integrations #

App stores on e-commerce platforms make it easy to add reviews, marketing, shipping and accounting tools. Each app you install may receive access to your orders and customer data. Install only what you use, check what each app is allowed to see, and remove apps you no longer need.

4. Keep card data out of your hands #

Use the payment options provided through your platform and let customers pay on the payment provider's side. Never ask customers to send card numbers by WhatsApp, email or a custom form. Keeping card data away from your own systems is the simplest way to stay safe and to keep your PCI DSS obligations small.

5. Protect your domain name #

If you use your own domain, the account at your domain registrar is as important as your store account. Turn on two-step verification there, enable the registrar lock if it is offered, and keep the renewal on automatic payment with a card that will not expire unnoticed. A lost domain means a lost store.

6. Secure your business email #

Your email receives password resets for everything else. Protect it with two-step verification and ask whoever manages your domain to set up SPF, DKIM and DMARC records, which make it much harder for criminals to send fake emails in your name to customers and suppliers.

7. Expect phishing aimed at merchants #

Attackers send messages that look like they come from the platform, a payment provider or a shipping company, asking you to "verify your account" or "confirm a payment". Do not log in through links in messages. Open the dashboard from your own bookmark instead, and confirm unusual requests by phone.

8. Treat customer data with care #

Names, phone numbers and addresses are personal data under the Personal Data Protection Law. Export customer lists only when needed, do not keep spreadsheets on personal laptops or shared drives without control, and delete exports once their purpose is served.

9. Watch for fraud and unusual activity #

Review new staff accounts, changed bank details, unusual discount codes and bursts of orders with mismatched addresses. Many platforms send notifications for sensitive changes, so make sure they go to an inbox someone actually reads.

10. Have a simple incident plan #

Write down, on one page, what to do if the store or an account is compromised: who to call at the platform, how to change passwords and remove sessions, how to inform customers, and who decides. A plan written on a calm day works far better than improvising during an incident.

When you build beyond the platform #

Many growing stores add a custom website, a mobile app, an API connection to an ERP or a marketing landing page. Those additions sit outside the platform's protection, and they are where real weaknesses tend to appear: exposed admin pages, broken access control and leaked keys. Anything custom deserves a security test before launch and after major changes.

A quick self-check #

You are in good shape if you can answer yes to these:

  • Two-step verification is on for the owner account, email and domain registrar.
  • Every staff member and agency has their own account with limited permissions.
  • You know which apps can read your customer data.
  • Customers never send card details outside the platform's checkout.
  • There is a one-page plan for a compromised account.

If some answers are no, start with the first three steps this week. They close the most common ways into a store.

Learn more about the NCA Cybersecurity Guidelines for e-Commerce and web application penetration testing.

Frequently asked #

Is my Salla or Zid store secure by default?

The platform secures its own infrastructure and checkout. Your owner and staff accounts, connected apps, domain, email and customer data exports are your responsibility to protect.

Do I need PCI DSS if I use the platform's payment options?

If customers pay through the platform's payment provider and card data never touches your systems, your PCI DSS obligations stay small. Collecting card details yourself, by message or form, brings much larger obligations and risk.

What is the most important first step?

Turn on two-step verification for the owner account, your business email and your domain registrar, and give every staff member their own account with limited permissions.

Are there national guidelines for online store security?

Yes. The National Cybersecurity Authority and the Saudi e-Commerce Council published Cybersecurity Guidelines for e-Commerce, with one document for service providers, including small and home-based sellers, and one for consumers.

Official Sources and References #

The documents behind this page, linked at the publisher. Where a Saudi regulation is published in both languages, the Arabic text is the binding version.