Security Policy

Effective date: 22 October 2026 · Owner: KLAVTAR Sp. z o.o. · Contact: klavtarlab@gmail.com

This policy describes how ShopFlow protects merchant and customer data, including protected customer data received from Shopify.

1. Data minimisation

We request only the data needed for order management and fulfillment: customer name, shipping address and phone number. We do not request customer email addresses from Shopify and do not process payment card data.

2. Encryption

• In transit: all traffic uses HTTPS/TLS; connections to the database and sub-processors are encrypted.
• At rest: the production database (Supabase, EU) is encrypted at rest, and its backups are encrypted. Store access tokens are additionally encrypted with AES-256-GCM using a key kept outside the database.

3. Environment separation

Production customer data is never copied into development or test environments. Automated tests run on a separate, disposable test database with synthetic data only; the Shopify integration credentials exist only in the production environment.

4. Access control

• Customer personal data is readable only through a single access module that checks that the order's store belongs to the requesting account; team members, agents and API tokens see only the stores and sections granted to them.
• Platform staff access to production systems is limited to named administrators, protected by multi-factor authentication, and granted on a least-privilege basis.
• Secrets are stored in the hosting provider's encrypted environment variables, never in source code; an automated check blocks secrets from being committed.

5. Passwords

Account passwords must be at least 12 characters long and combine letters, digits and special characters. Passwords are stored only as salted hashes. Staff accounts on infrastructure providers use strong unique passwords and multi-factor authentication.

6. Access logging

Every read of customer personal data is recorded in an access log (who, when, which order, through which channel — without the personal data itself). Logs are reviewed at least monthly and when an incident is suspected.

7. Data loss prevention

• Customer personal data is never written to application logs, notifications, webhooks to third parties, or AI model prompts.
• Exports and APIs for agents and integrations return order data without customer personal data.
• Automatic deletion after the retention period (90/120 days) limits the amount of data at risk.
• Code changes affecting data access go through review and automated tests that guard the single access path.

8. Retention and deletion

Retention periods and deletion on Shopify customers/redact and shop/redact requests are described in the Privacy Policy.

9. Security incident response

Severity levels

• Critical: confirmed unauthorised access to or loss of customer personal data, or leaked credentials with access to production.
• High: suspected exposure, or a vulnerability that could expose personal data.
• Medium/Low: security issues without data exposure.

Roles. The incident lead is the ShopFlow technical owner at KLAVTAR Sp. z o.o.; the company management board is informed of every Critical or High incident.

Process.

1. Detect and report: anyone who notices an incident reports it to klavtarlab@gmail.com or +48 516 090 280.
2. Contain: revoke affected tokens and credentials, disable affected integrations, block malicious access.
3. Preserve evidence: keep access logs, deployment history and database audit records; record a timeline.
4. Assess: determine affected data, stores and customers, and severity.
5. Notify: affected merchants without undue delay and within 72 hours of becoming aware of a breach of their customers' data; the supervisory authority (UODO) where required by the GDPR; Shopify where required by the Partner Program.
6. Recover and review: fix the root cause, rotate secrets, document lessons learned and update this policy.

10. Review

This policy is reviewed at least once a year and after every Critical or High incident.