ENCRYPTION
In transit and at rest
TLS 1.2+ everywhere, AES-256 for stored data, secrets in a managed vault with rotation.
ACCESS
Least privilege by default
Role-based access, SSO for staff, audit logs on every read of shopper data, no standing production access.
INFRASTRUCTURE
Isolated and monitored
Per-tenant data isolation, automated backups with point-in-time restore, 24/7 alerting.
SHOPIFY
Reviewed app, scoped permissions
We request only the Shopify scopes a feature needs and pass Shopify’s protected customer data review.
INCIDENTS
Disclosed within 72 hours
A documented response process, merchant notification within 72 hours of a confirmed incident, and post-mortems shared on request.
COMPLIANCE
GDPR and DPDP ready
Data processing agreement available, data residency in India or the EU on request, SOC 2 Type II in progress.
We share our security documentation with prospective customers under NDA.