Security and incident response

Data minimization and retention

• Customer contact details are read live from Shopify and are not written to the App database.
• Operational records (message log, access log, rule runs) contain identifiers and counts only and expire after 90 days; webhook receipts expire after 7 days.
• All shop data is deleted on uninstall and again when Shopify sends the shop-redaction webhook.

Encryption

• TLS for every connection: Shopify to the App, the App to Shopify, the App to the database, and the App to any merchant-configured endpoint (HTTPS only).
• The production PostgreSQL database and its automated backups are encrypted at rest by the database provider.
• Merchant signing secrets are additionally encrypted at the application layer with AES-256-GCM using a key held only in the hosting provider’s encrypted environment configuration.

Access control and logging

• Every App screen authenticates through Shopify session tokens; every webhook is verified with Shopify’s HMAC signature.
• Database queries are scoped to the requesting shop.
• Staff access to production systems is limited to the App owner, protected by strong unique passwords and two-factor authentication on Shopify Partners, the hosting provider, and the database provider.
• Each read of protected customer data is written to an access log that merchants can inspect on the Activity page.
• Customer data is never written to application logs.

Environment separation and data loss prevention

• Development uses a local database and development stores; production uses a separate managed database with its own credentials.
• The database provider keeps point-in-time recovery for the production database.
• The App’s outbound connector refuses non-HTTPS, private, loopback, and link-local destinations, and re-validates the destination on every send.

Incident response

1. Detect and contain. On suspicion of unauthorized access or data exposure, affected credentials (Shopify API secret, database credentials, encryption key) are rotated and the affected deployment is disabled within hours of detection.
2. Assess. We determine which shops, data categories, and time window were affected using access logs, hosting logs, and database audit information.
3. Notify. Affected merchants are notified by email without undue delay and within 72 hours of confirmation, with the facts known, the likely impact, and the steps taken. Shopify is notified through Partner support where the platform is affected.
4. Remediate and review. The root cause is fixed, the fix is verified, and this policy is updated with lessons learned.