Security

Infrastructure

• Apps run on Railway with managed PostgreSQL. Volumes and backups are encrypted at rest.
• All traffic is served over TLS. There is no plaintext endpoint.
• Production and testing are separate environments with separate databases. Test activity never touches merchant data.
• Secrets are held as environment variables in the host's secret store, not in source control.

Application

• Every webhook is HMAC-verified against the app's shared secret before it is processed. Unverified payloads are rejected.
• Sessions use Shopify's offline access tokens with rotation, stored server side, never exposed to the browser.
• Each app requests the narrowest scopes that let it work. The contact form app requests no Admin API scopes at all.
• Reads of a buyer's personal data are written to an access log recording the shop, the fields and the purpose. The log line never contains the personal data itself.

Data loss prevention

Databases are backed up by the platform on a rolling schedule with point-in-time recovery. Deletions triggered by Shopify's privacy webhooks are permanent and are not recoverable from backup after the retention window, which is the intended behaviour for a redaction request.

Incident response

If we become aware of a security incident affecting merchant or customer data, we will:

• Contain it and assess what was affected.
• Notify affected merchants and Shopify within 72 hours of becoming aware.
• Tell you what happened, what data was involved and what we are doing about it, rather than a generic notice.
• Publish a post-incident summary once it is resolved.

Audits and certifications

None to date. We would rather say that plainly than imply a certification we do not hold. If your procurement process needs one, tell us which and we will tell you honestly whether and when we can meet it.

Reporting a vulnerability

Email support@appal.io with the subject line starting SECURITY. Include what you found, how to reproduce it and how you would like to be credited. We will acknowledge within one business day.

Please do not run automated scanning against production, access data that is not yours, or degrade service for merchants while testing. Report it and we will work with you.