Skip to main content

Free forever plan · 3,468 shops live · No credit card to start

Start free
Trust Center

Straight answers before you trust us with your shop

Each answer below is checked against how the product works today. Where we have not verified an answer yet, it says so instead of guessing.

Will my customers be able to order?

Last verified November 5, 2026

Your shop, checkout, and dashboard are hosted by Cloudflare, one of the largest companies running the web’s infrastructure, and card payments are handled by Square or Stripe. We do not publish an uptime number yet, because we do not yet run an outside monitor that measures it, and a number without a measurement behind it would not tell you anything. Cloudflare and our payment and messaging providers each publish their own status pages, linked below.

Where it runs
Cottage CMS is hosted by Cloudflare, which runs its own security program and its own public status page. Updates to the product go live only after they pass automated checks.
Status page
Cottage CMS does not have its own status page yet. Our hosting provider’s page, cloudflarestatus.com, shows problems with the platform we run on, but it cannot show a problem in our own software.
Uptime figure
None published yet. When we publish one, it will come from an outside monitor that has watched the service for a stated period, with the method shown next to the number.
Payments
Card payments are handled by Square or Stripe, whichever you connect. A declined card is the payment company’s decision and does not count as an outage. A checkout that fails before it reaches them does.

Where to check during a problem

These pages belong to the companies we build on. They show problems on their side, not problems in Cottage CMS’s own software, which is why we still owe you a status page of our own.

What a status page will track

  • Storefront

    Your shop pages load at your web address.

  • Checkout and order creation

    A customer can finish checkout and the order is saved.

  • Dashboard

    You can sign in and see new orders.

  • Order emails and texts

    Order emails and texts are handed to the companies that deliver them. Handing a text to the phone network is not the same as the phone receiving it.

Incident history

Recorded here since November 5, 2026.

No incidents recorded since this log started.

Can I take my business elsewhere?

Last verified November 5, 2026

Yes. Your customer list, product catalog, and order history can be downloaded on every plan as spreadsheet files that open in Excel, Numbers, or Google Sheets. A few kinds of records cannot be downloaded in bulk yet, and the list below says which.

Export manifest

Customers

Every plan

Sample CSV
Where:
Dashboard › Settings › Account › Download your data, or the export menu on the Customers page
Format:
A spreadsheet file (CSV) from Account settings; CSV or Excel with your choice of columns from the Customers page
Notes:
Up to 50,000 customers per download. Amounts are in your shop’s currency.
17 columns
  • Name
  • Email
  • Phone
  • Account type
  • Account status
  • Email verified
  • Email subscription
  • Text subscription
  • Source
  • Total orders
  • Paid orders
  • Total spent
  • Average order value
  • Loyalty points
  • First order date
  • Last order date
  • Member since

Products

Every plan

Sample CSV
Where:
Dashboard › Settings › Account › Download your data, or the export menu on the Products page
Format:
A spreadsheet file (CSV) from Account settings; CSV or Excel with your choice of columns from the Products page
Notes:
Product photos, recipes, option pricing rules, and availability schedules are not included.
10 columns
  • Name
  • Description
  • Category
  • Price
  • Status
  • Shop visibility
  • Shippable
  • Has variants
  • Variant names
  • Created date

Orders

Every plan

Sample CSV
Where:
Dashboard › Orders › export menu
Format:
CSV or Excel. Choose the columns, a date range, all orders or just the ones you have filtered, items in one cell or one column per item, and an optional totals row.
Notes:
The sample shows every column with the items in one cell. Dates and times use your shop’s time zone.
27 columns
  • Order Number
  • Source
  • Status
  • Date Placed
  • Time Placed
  • Customer Name
  • Email
  • Phone
  • Customer Note
  • Fulfillment Type
  • Fulfillment Status
  • Fulfillment Date
  • Fulfillment Time
  • Pickup Location
  • Delivery Address
  • Delivery Instructions
  • Tracking Number
  • Carrier
  • Subtotal
  • Tax
  • Tip
  • Discount
  • Delivery Fee
  • Total
  • Payment Method
  • Payment Details
  • Items

Sales reports

Plans that include Analytics

Where:
Dashboard › Analytics
Format:
A spreadsheet file (CSV) of paid orders and items sold for the dates you choose

Text messaging consent file

Plans that include text messaging

Where:
Dashboard › Notifications › Export compliance
Format:
A data file a compliance reviewer can read
Notes:
Contains the consent wording your customers agreed to and the most recent consent events, import attestations, and opt-outs. It is evidence for a review, not a complete history.

Samples use made-up businesses, people, and orders, with the same columns and formatting as a real export.

Not exportable today

Recipes and ingredients
No bulk download. A bake plan can be saved as a PDF.
Website pages and blog posts
No download. Copy the text from the editor or your live site.
Media library
No bulk download. Files can be opened and saved one at a time.
Full messaging consent history
No complete download. The customer file shows each customer’s current email and text subscription status, and the consent file holds only recent records.
Other records
Reviews, form submissions, gift card and store credit balances, customer subscriptions, newsletters, and inbox email have no bulk download today.

How to download and open your data

  1. Sign in and open Dashboard › Settings › Account.
  2. Under “Download your data,” choose Download customers and Download products. Each file saves to your computer.
  3. Open Dashboard › Orders, open the export menu, choose All orders and the columns you want, then pick CSV or Excel.
  4. Open the files in Excel, Numbers, or Google Sheets. Accents and special characters come through correctly.
  5. If a cell would start with =, +, - or @, we add an apostrophe in front so your spreadsheet treats it as text rather than a formula.

After a downgrade

  • Your products, customers, orders, pages, and posts stay stored in the account.
  • Features the lower plan does not include stop working or stop being public. On Free, a custom domain stops serving the storefront and visitors may be sent to your Cottage CMS address.
  • Paid access normally continues until the end of the current billing period.
  • A domain you bought through us is billed separately from the plan and keeps its own renewal.

After closing your account

  • Closing requires the account owner, an exit reason, the word DELETE, and your current password. It is blocked while a paid subscription is active or Square is still connected.
  • Your storefront and dashboard are switched off as soon as closure is accepted, though public pages can linger in browser and search caches for a short while. Your data is then deleted in stages. Closing is not a pause, and there is no way to restore the account afterward.
  • Download your files before you close. We cannot produce them for you after deletion.
  • Domain registrations and accounts you hold directly with Square, Stripe, or another company are separate and are not closed for you.

Customer consent does not travel with the file

A phone number or email address in your download does not carry marketing permission to another tool. Your customers gave consent to your business through Cottage CMS’s wording; before texting or emailing them from a new tool, check that tool’s rules and collect consent again where it requires it.

As a solo-run business, what happens when the owner is unavailable?

Last verified November 5, 2026

Cottage CMS is built and run by one person, so this is a fair question. Day-to-day help does not depend on the owner being at a keyboard: most support is automated, it runs around the clock, and the fixes it applies have been tested.

Help inside the dashboard
Cottage Copilot answers questions about your shop and can prepare changes for you to approve, at any hour. It works from your shop’s own settings and records.
Help from your own AI assistant
If you use ChatGPT, Claude, or a similar assistant, you can connect it to your shop through a standard connection called an MCP server. Your assistant can then look things up and help you make changes, with the same permissions and approvals as the dashboard.
Email support
Email to support@cottagecms.com is read and answered first by an automated assistant, DrewBot, around the clock. It handles the common questions on its own.
When something is actually broken
Problems the assistants cannot resolve become support tickets automatically and are escalated. Known problems have tested, automated fixes that run without waiting for a person.
A bug that needs a code change
An automated process handles this too. The problem is identified and triaged, a small, bounded fix is prepared, and it goes through several rounds of AI review. Only a fix that passes clean review is released, through the same automated checks every release passes. Fixes are deliberately kept small; larger changes still wait for the owner.
If Cottage CMS shuts down
We do not expect this to happen. In the extremely unlikely event that it ever did, we are committed to giving at least 180 days’ notice, keeping your downloads available for that whole period, and putting extra work into making them as complete as possible, including records that have no bulk download today.

What exactly protects my information?

Last verified November 5, 2026

A plain list of what protects your account today, and what does not exist yet. The companies we build on hold their own security certifications; Cottage CMS has none of its own.

Signing in
You sign in with an email and password, or with a passkey. Passwords are never stored as typed; they are scrambled with a one-way method, so even we cannot read them. Repeated wrong attempts lock sign-in for a while.
Two-factor authentication
Not available for dashboard accounts yet; Account settings shows it as Coming Soon. A passkey is the strongest sign-in option today. Your customers can sign in to your shop with a one-time code texted to their phone.
Signed-in devices
Account settings lists every device signed in to your account. You can sign out one of them or all of the others, and changing your password signs you out everywhere else. The sign-in cookie is shielded from other code running in the browser, and we keep only a scrambled copy of it on our side.
Keeping shops apart
Every record is tagged with the shop it belongs to, and the system only returns records for the shop you are signed in to, even when a record is requested by its ID. A shop ID sent from a browser is never trusted as proof of access.
Stored secrets
The Google connection keys we hold for you are encrypted before they are stored. Everything else we store is protected by our hosting provider’s storage encryption.
Backups and restore
There is no separate, conventional backup copy kept somewhere else. Instead, each layer has its own protection. The product’s code is kept in version control, so any release can be rolled back. The database is kept by our hosting provider with restorable checkpoints, so it can be put back to any minute within about the past 30 days. Photos and files are kept on the provider’s durable file storage, built to keep files safe even when hardware fails. A database restore puts everything back to that moment for every shop at once, so it is a last resort rather than a per-shop undo. We have not yet published a tested restore exercise.
Dashboard Copilot
The Copilot can read your shop’s records but cannot change them on its own, and its view of orders leaves out customer contact details, addresses, and payment details. It can prepare a change for you, but only the shop owner can approve it, and the approved change goes through the same checks as one made in the dashboard. If you ask for a person, it drafts an email to support@cottagecms.com that is sent only after you approve it. There is no phone support.
Reporting a security problem
Email support@cottagecms.com and describe what you found. There is no separate security address or bug bounty program yet; reports go to the same inbox as other support email, which aims to reply within 24 hours. The same address is published for security researchers in the standard security.txt file at /.well-known/security.txt (also served at /security.txt).

Service providers that handle your data

Cloudflare
Hosts the service and stores its data and files, routes email, blocks bots and spam, and provides the AI models behind the dashboard Copilot.
Square
Card payments, catalog sync, and in-person sales when you connect it.
Stripe
Our own subscription billing, and card payments when you connect it.
Twilio
Delivers text messages and sign-in codes.
Resend
Delivers email.
Google
Optional connections to Search Console and Business Profile, maps for delivery distances, and optional analytics.
hCaptcha
Spam protection on contact forms.
Vercel
Domain search and registration when you buy a domain through us.

The Privacy Policy describes what we collect and your rights. Each provider’s own certifications and terms apply to that provider.

Page reviewed November 5, 2026.