Security and retention

How your data and your customers' data are protected. The server controls below were checked on the production server on 18 October 2026.

• HTTPS is required for public traffic.
• The database sits on an encrypted volume (LUKS2, AES-XTS).
• Daily backups are encrypted with AES-256, kept for 30 days and then deleted. A restore from backup was tested on 18 October 2026.
• Server access is by SSH key only. Root and password logins are disabled.
• The app listens only on the server's local interface, behind Nginx and Cloudflare, and the host firewall is active.
• Development and review use a separate Shopify app configuration and development stores, never production data.
• Authenticated reads and downloads of customer documents and privacy exports are recorded without copying customer content into the log.
• Data minimisation, PII scrubbing, expiry jobs and Shopify redaction webhooks form the data-loss-prevention strategy.
• Shopify shop redaction permanently deletes the shop's documents and operational records; only a content-free numbering continuity marker remains.
• A documented incident process covers containment, evidence preservation, impact assessment, notification and recovery.

See the privacy policy for the detailed retention schedule.