Security
Last updated: Counsel to supply
In short
- We store your store's access token encrypted.
- Every query is limited to your own store.
- Calls from Shopify are verified before we act on them.
- When Shopify asks us to delete data, we delete it.
Store tokens are encrypted at rest
The access token Shopify gives us for your store is encrypted before it is saved.
Every store's data is isolated
Each query is scoped to a single store, so one store's data is never returned for another.
Shopify calls are verified
Endpoints that Shopify calls check a signature (HMAC) before they do anything.
GDPR requests are handled
Customer data requests and redaction arrive through Shopify's GDPR webhooks and are processed for you.
Staff access is logged
When our staff look at a store to help, the access is recorded.
Responsible disclosure
Found a vulnerability? Email support@marginlabs.app. Counsel to supply the policy