Security

01Infrastructure

• Hosting: Production workloads run on SOC 2 Type II certified cloud providers in geographically isolated regions.
• Encryption in transit: All traffic uses TLS 1.2+ with modern ciphers. HTTP requests are upgraded to HTTPS at the edge.
• Encryption at rest: Databases, backups, and object storage are encrypted with AES-256 keys managed by the cloud provider's KMS.
• Network isolation: Application servers sit in a private VPC; only the load balancer is exposed publicly.

02Application Security

• Shopify OAuth: We use Shopify's official OAuth flow. Tokens are scoped to the minimum permissions required for order edits.
• Webhook verification: Every webhook is HMAC-verified against the store's shared secret before processing.
• Per-store isolation: Each merchant's data is logically partitioned. Customer-facing actions can never reach another merchant's orders.
• Audit logs: Every order modification is logged with actor, timestamp, before/after state, and originating IP.

03Access Control

• Least privilege: Engineers only receive access to production systems that they need to do their job.
• Hardware MFA: All employee accounts on production systems require hardware-backed multi-factor authentication.
• SSO: Internal tools are gated behind single sign-on with mandatory device posture checks.
• Key rotation: API keys, database credentials, and signing secrets are rotated on a scheduled cadence.

04Development Lifecycle

• Code review: Every change is peer-reviewed before merge. No direct pushes to the production branch.
• Static analysis: Dependency vulnerabilities and known insecure patterns are flagged on every pull request.
• Secret scanning: Commits are scanned for accidentally committed credentials before they hit the main branch.
• Staging environment: Releases ship to a staging tier and run through automated checks before production rollout.

05Data Handling

• Minimum data: We only request the Shopify scopes strictly required to operate the order-edit flow.
• Retention: Customer data is retained only as long as the merchant's account is active, or as required by law.
• Uninstall cleanup: When a store uninstalls the app, associated merchant and customer data is purged on a fixed schedule.
• Backups: Encrypted backups run on a daily schedule with point-in-time restore for production databases.

06Monitoring & Incident Response

• 24/7 monitoring: Production health and error rates are monitored continuously with on-call rotation.
• Anomaly detection: Unusual access patterns and failed-auth spikes trigger automated alerts.
• Disclosure timeline: Confirmed incidents affecting merchant data are disclosed to impacted stores within 72 hours.
• Postmortems: Every Sev-1 incident produces a blameless postmortem with concrete remediation actions.

07Compliance

• Shopify Built-for-Shopify: The app follows Shopify's protected customer data requirements and partner program guidelines.
• GDPR: We support data subject access, rectification, and deletion requests for EU customers.
• CCPA: California residents can request access to or deletion of their personal information via the merchant.
• Subprocessors: A current list of subprocessors is available on request from the contact below.

08Responsible Disclosure

If you believe you have found a security vulnerability, please report it to us privately before any public disclosure. We will acknowledge receipt within two business days and keep you informed of progress toward a fix. We do not pursue legal action against researchers who follow responsible disclosure in good faith.

09Contact

For security questionnaires, compliance documentation, or to request our current subprocessor list, reach out to the team below.