How we protect data
- Encryption. All traffic uses HTTPS (TLS). Our database provider encrypts data at rest, and each store's Shopify access token is additionally encrypted with AES-256-GCM using a key kept outside the database.
- Minimal data. We store a slim copy of each order with only the fields our checks use, keep it for 30 days unless it was flagged, and keep longer-term history only as keyed one-way fingerprints that can't be read back or matched across stores.
- Isolation. Every query is scoped to the store making the request, verified from Shopify's signed session token. One store can never see another store's data.
- Least access. Apps request only the Shopify permissions they use. Production data is accessible only to the people who need it to run and support the apps, and every account that can reach it (hosting, database, code and Shopify Partner) is protected by two-factor authentication.
- Secrets. API keys and credentials live in our hosting provider's encrypted environment settings, never in code.
- Verified webhooks. Every webhook from Shopify is checked against its signature before we act on it.
- AI calls. The AI look-alike check receives only the two values being compared, and the provider does not train on them.
- Providers. We use established infrastructure providers, listed in our privacy policy.
Incident response
An incident is any event that may have exposed, altered, lost or made unavailable data we hold for a store. When we suspect one, we follow these steps.
- Detect and record. Alerts, provider notices, merchant or researcher reports are triaged at once. We open an incident record with a timeline and an owner.
- Contain. We stop the exposure first: revoke or rotate affected credentials and tokens, block the access path, and pause affected features if needed. Screening fails safe: it does not cancel or release orders on its own.
- Assess. We work out what data, which stores and which people are affected, how, and since when, using logs from our providers.
- Notify. If a personal data breach is confirmed, we notify affected merchants without undue delay, and within 72 hours, by email to the store's contact address and in the app. We tell you what happened, what data was involved, what we have done and what you may need to do. We also notify Shopify as its Partner terms require, and authorities where the law requires us to notify them directly. As controller, you decide whether to notify your customers, and we give you the facts to do so.
- Fix and recover. We remove the cause, restore from backups if data was lost, and confirm the fix before closing the incident.
- Review. Within two weeks we write a post-incident review covering root cause and the changes that prevent a repeat, and share a summary with affected merchants.
We keep incident records for at least three years and review this plan at least once a year.
Report a vulnerability
If you believe you have found a security issue in one of our apps or this website, email security@shopgrowth.ai with the details and steps to reproduce. Please give us reasonable time to fix it before sharing it publicly, and don't access other stores' data, degrade service or run automated scans against stores. We will acknowledge your report promptly and keep you updated.