Security and incident response

This page describes how the Textile Compliance for Shopify app protects the data it holds, and what we do if something goes wrong. It supplements the privacy policy.

What we hold, and what we do not

The app keeps the minimum needed to check textile product data: store details, product data, the compliance data a merchant enters, and order summaries (order reference, date, quantity and destination state and country). It does not store customer names, email addresses, phone numbers, street addresses or payment details. Holding less data is the first security measure.

Security measures

• Encryption in transit. All traffic between the merchant’s browser, Shopify, the app and its database uses TLS.
• Encryption at rest. App data is stored with our hosting provider (Railway), which states that the underlying storage is encrypted at rest. Backups are made by the same provider.
• Backups and recovery. Scheduled database backups are enabled so data can be restored after loss or corruption.
• Test and production are separate. Development uses its own local database and Shopify test stores. Production data is never used for development or testing.
• Limited access. Production systems are accessed only by the operator (Igor Kazazic) and no one else. Accounts at the hosting provider, source repository and Shopify use unique passwords from a password manager and two-step verification.
• Secrets. API keys, signing secrets and database credentials are stored as environment variables at the host, never in the source code.
• Signed requests. Every request from Shopify is verified with its signature (session token or webhook HMAC) before anything is read or changed. Download links are signed and expire after 15 minutes.
• Access to order data is logged. The app records in the store’s change history every time order data is read from Shopify, viewed, imported or exported (who, when, and how many records, never the contents).
• Change history. Edits to product compliance data are recorded with who, when and the previous value.
• Data deletion. When the app is uninstalled, Shopify’s deletion request removes the store’s data. If it never arrives, data is deleted 30 days after uninstall.

If something goes wrong: incident response

A security incident means any event that puts the confidentiality, integrity or availability of merchant data at risk, such as unauthorised access, data loss, a leaked secret, or a vulnerability that has been exploited.

1. Detect and report. Incidents are found through hosting alerts, error logs, merchant reports or security researchers. Anyone can report a suspected incident or vulnerability to igorkazazic1989@gmail.com. We acknowledge reports within two business days.
2. Contain. We act immediately to stop the exposure: revoke or rotate affected keys and tokens, disable the affected feature or the service, and block the access path.
3. Assess. We establish what happened, which stores and which data were affected, and whether personal data is involved. The findings are written down with a timeline.
4. Notify. If merchant data is affected, we tell the affected merchants without undue delay and in any case within 72 hours of confirming the incident. The message says what happened, which data, what we have done and what the merchant should do. Where personal data is involved and the law requires it, we also notify the Swedish Authority for Privacy Protection (IMY) within 72 hours, and Shopify where its requirements apply.
5. Recover and fix. We restore the service and data from backup if needed, fix the root cause and check that the fix works before reopening.
6. Review. Within two weeks of closing an incident we write a short review of the cause and the changes we will make, and keep it as a record.

Reporting a vulnerability

If you find a security problem, email igorkazazic1989@gmail.com with enough detail to reproduce it. Please do not access other merchants’ data or disrupt the service while testing. We will not take action against good-faith research.

Third-party audits and certifications

The app has not been audited or certified by a third party. The measures above are our own, and we will update this page if that changes.