Security

How we protect data

• All traffic uses HTTPS.
• Merchant sign-in uses Shopify's own authentication; we never see Shopify passwords. Shopify access tokens stay on the server.
• Partner passwords are stored only as salted scrypt hashes. Sign-in sessions and email links use long random tokens; only their hashes are stored. Repeated wrong passwords lock an account for a time.
• Payout details a partner chooses to add are encrypted at rest (AES-256-GCM) with a key kept outside the database and shown only to the merchant who pays that partner.
• Forms check that requests come from our own pages, and public forms have protection against automated sign-ups.
• Webhooks from Shopify are accepted only when their signature is valid.
• Access to the production database and settings is limited to the few people who operate the app and needs strong authentication.
• Automated tests cover the money calculations and the input checks, and changes are tested before they go live.
• We store no card numbers or bank logins. The subscription is paid through Shopify.

Data retention and backups

Data is kept while the app is installed. After uninstalling, shop data is deleted as described in the Privacy Policy. Database backups, where we keep them, are not kept longer than 35 days, so deleted data disappears from backups within that time.

If something goes wrong

• We investigate every report of a possible incident and record what happened and what we did.
• If merchant data is affected, we tell the merchants concerned without undue delay, as set out in the Data Processing Addendum, and help them meet their own duties.
• Where the law requires, we notify the supervisory authority within 72 hours of becoming aware of a breach that is likely to put people at risk.
• After an incident we fix the cause and add a test or check so it does not repeat.

Report a vulnerability

If you find a security problem, write to Bochichenko@gmail.com with the steps to reproduce it. Please do not access other people's data, do not disrupt the service and give us reasonable time to fix it before you publish anything. We will reply, keep you informed and thank you for responsible disclosure.