Security & incident response

• Shopify OAuth with HMAC signature verification and single-use, server-stored state values.
• The Shopify access token is stored server-side only. It is never sent to the browser, never placed in a URL, and is destroyed when the app is uninstalled.
• Sessions use signed, HTTP-only, Secure cookies. The authenticated shop is derived from that signature, never from a client-supplied parameter.
• Every webhook is HMAC-verified before any processing occurs; unverified requests are rejected.
• Scheduled jobs require a bearer secret; there are no publicly executable endpoints.
• All secrets are held in environment variables and are never committed to source control.

• TLS for all connections to Shopify, the database and the email provider.
• Encryption at rest for the database and its backups, provided by Neon.
• Point-in-time recovery for the database.
• Data minimisation: only two protected customer fields are read, and only read-only Shopify scopes are requested.
• Test and production data are separated; demo data is synthetic and flagged distinctly.
• All reads of customer name or email are recorded in an access log.

Access to production systems is limited to the app developer, protected by two-factor authentication on the Shopify Partner, Vercel and Neon accounts. Credentials are not shared, and access is reviewed when anyone joins or leaves.

If a security incident affecting personal data is suspected, the following steps are taken:

1. Detect and triage — assess scope, what data is involved and whether it is ongoing.
2. Contain — within 24 hours: rotate the affected credentials (Shopify API secret, session secret, database credentials, email API key), and revoke sessions if needed.
3. Assess — use webhook records and the data access log to establish which stores and which records were affected.
4. Notify — inform affected merchants without undue delay, and Shopify Partner support, within 72 hours of becoming aware. Notification states what happened, what data was involved, what has been done, and what the merchant should do.
5. Remediate and review — fix the root cause, then record the incident, timeline and corrective actions.

Suspected vulnerabilities can be reported through the support address on the app listing. Reports are acknowledged within three business days.

Stated plainly rather than omitted: StorePulse has not undergone a third-party security audit and holds no SOC 2 or ISO 27001 certification. It is operated by a small team, and the measures above are those appropriate to that scale.