Security and Data Protection

Data minimisation

The most effective control here is that almost nothing is collected. Storefront events go from the shopper's browser straight to OpenAI without touching our servers. Order data is processed in memory and discarded. No customer personal data is written to disk at any point.

Encryption

• In transit: TLS for every connection, to Shopify, to OpenAI and to the database.
• At rest: the OpenAI API key is encrypted with AES-256-GCM under a key held only in the server environment and never in source control. No customer personal data is stored, encrypted or otherwise.
• Backups: database backups are managed and encrypted by the hosting provider. They contain no customer personal data.

Data loss prevention

• Direct identifiers are hashed with SHA-256 before leaving the process; raw values are never transmitted.
• Automated tests fail the build if a raw email address, phone number, name, order identifier or checkout token appears in an outgoing payload.
• Browser requests are restricted to the fields OpenAI documents, and personal data is never placed in a query string.
• Secrets are supplied through environment variables and are excluded from source control.

Separation of environments

Development uses a local database and Shopify test billing. Production credentials and production data are never used in development, and the two databases are entirely separate.

Access control

• Access to the production environment and database is limited to staff who need it to operate the service.
• Accounts with access require strong, unique passwords and multi-factor authentication where the provider supports it.
• Application logs record the shop domain, the outcome of each conversion event, and nothing else. They contain no personal data.

Incident response

If a security incident is suspected, the following process applies.

• Severity: critical means personal data or credentials may be exposed; high means the service is unavailable or sending incorrect data; low is everything else.
• Roles: the app developer is the incident owner and single point of contact until the incident is closed.
• Containment: rotate the affected credentials, revoke sessions if needed, and take the service offline if continuing would worsen the exposure.
• Evidence: preserve application logs, deployment history and the relevant database state before making changes.
• Notification: affected merchants are notified without undue delay, and Shopify is notified where the incident affects merchant or customer data.
• Review: after closure, record the cause and the change made to prevent recurrence.

Third-party audits

No third-party security audit or certification has been carried out. This statement will be updated if that changes.