We implement industry-standard security practices to protect your data:

In Transit

• – All data transmitted between your browser and our servers is encrypted using HTTPS/TLS 1.2 or higher
• – All API requests to Shopify are encrypted and authenticated

At Rest

• – Customer and configuration data is encrypted using AES-256 encryption while stored in our database
• – Database credentials and API keys are encrypted and access-restricted
• – Sensitive data such as authentication tokens are hashed before storage

Access Controls

• – Access to production systems is restricted to authorized personnel only
• – We use role-based access control (RBAC) to limit staff access to customer data
• – Strong password requirements are enforced for all staff accounts (minimum 12 characters, complexity requirements)
• – Multi-factor authentication (MFA) is required for access to production systems

Monitoring & Logging

• – All access to customer data is logged and audited
• – System access logs are retained for 90 days
• – Unauthorized access attempts are detected and alerted immediately
• – We monitor for suspicious activity on a continuous basis

Backups

• – Database backups are created daily and encrypted using AES-256
• – Backups are stored in geographically distributed secure locations
• – Backup access is restricted to authorized personnel only
• – Backups are tested regularly to ensure recoverability

Data Separation

• – Test and production environments are completely isolated
• – Production data is never used in development or testing
• – Each environment has separate authentication, encryption keys, and access controls

Data Loss Prevention

• – Our infrastructure includes redundant storage systems across multiple availability zones
• – Automated failover systems ensure continuous service availability
• – Regular disaster recovery drills ensure our ability to recover from data loss
• – We maintain detailed disaster recovery and business continuity plans

Authentication

• – We use Shopify OAuth for authentication — we never request or store your Shopify password
• – All API communications use HMAC verification to validate requests
• – Session tokens expire after 24 hours of inactivity

Incident Response

• – We have a documented Security Incident Response Policy in place
• – If we detect a security breach, we will notify affected users within 48 hours
• – We maintain a security incident log for audit purposes
• – We conduct post-incident reviews to prevent future occurrences