Security, data loss prevention and incident response

Technical measures

• Data minimisation: sensitive fields (national ID, business number, birth information, social profile) are only collected when the merchant explicitly enables them. No payment card data is ever processed.
• Protected documents: ID documents and contracts are stored in the database, never on a public URL or CDN; they are only returned to an authenticated administrator of the store that owns them.
• Tenant isolation: every record is scoped to its store, and storefront pages only show the logged-in seller's own data (identity verified by Shopify's signed App Proxy requests).
• Encryption in transit: all traffic between the store, Shopify and the app uses HTTPS.
• Limited retention: unfinished applications are deleted after 60 days, rejected ones after 90 days; all store data is deleted after uninstall.
• Access logging: every view of a seller file, document, contract, application list or payout list by a store administrator is recorded (who, what, when) and kept for one year.
• Secrets: API keys are stored as environment variables on the hosting platform, never in source code.

Data loss prevention

The PostgreSQL database is hosted on Railway with managed backups. Commission balances are cached values that can always be recomputed from the immutable ledger of entries.

Incident response

• Detection through application logs and error monitoring on the hosting platform.
• Containment: revoke compromised credentials, rotate keys, restrict access.
• Notification of affected merchants without undue delay and within 72 hours.
• Post-incident review and corrective actions.

Report a vulnerability

nordship76@gmail.com