Security and incident response

Data minimization and retention

• Customer contact details are read live from Shopify for each lookup and are not written to the App database.
• Only the customer’s own orders are returned to the bot, at most three, without addresses, email addresses, phone numbers, prices, or payment details.
• The access log contains times and counts only and expires after 90 days; request identifiers expire after 15 minutes.
• All shop data is deleted on uninstall and again when Shopify sends the shop-redaction webhook.

Encryption

• TLS for every connection: Shopify to the App, the App to Shopify, the App to the database, and the App to ping.ai (HTTPS only).
• The production PostgreSQL database and its automated backups are encrypted at rest by the database provider.
• Connection credentials are additionally encrypted at the application layer with AES-256-GCM using a key held only in the hosting provider’s encrypted environment configuration.

Access control and logging

• Every App screen authenticates through Shopify session tokens; every webhook is verified with Shopify’s HMAC signature.
• Requests from the ping.ai WhatsApp bot are signed per store (HMAC-SHA256), accepted only within five minutes, single-use, and rate-limited per store and per customer.
• Database queries are scoped to the requesting shop.
• Staff access to production systems is limited to the App owner, protected by strong unique passwords and two-factor authentication on Shopify Partners, the hosting provider, and the database provider.
• Each order lookup is written to an access log.
• Customer data is never written to application logs.

Environment separation and data loss prevention

• Development uses a local database and development stores; production uses a separate managed database with its own credentials.
• The database provider keeps point-in-time recovery for the production database.
• Disconnecting in the App or uninstalling it revokes the ping.ai credential immediately.

Incident response

1. Detect and contain. On suspicion of unauthorized access or data exposure, affected credentials (Shopify API secret, database credentials, encryption key, ping.ai credentials) are rotated and the affected deployment is disabled within hours of detection.
2. Assess. We determine which shops, data categories, and time window were affected using access logs, hosting logs, and database audit information.
3. Notify. Affected merchants are notified by email without undue delay and within 72 hours of confirmation, with the facts known, the likely impact, and the steps taken. Shopify is notified through Partner support where the platform is affected.
4. Remediate and review. The root cause is fixed, the fix is verified, and this policy is updated with lessons learned.