SOC 2
Audit plannedOur program is mapped to the Trust Services Criteria for Security and Confidentiality. We don't hold a SOC 2 report yet. A formal audit is on our roadmap.
Compliance
Where our program stands against the frameworks merchants ask about most.
- In place today
- On our roadmap
GDPR
DPA availableWe act as a processor of your customers' data and offer a DPA with Standard Contractual Clauses. We honor Shopify's privacy webhooks within 30 days.
Shopify protected customer data
Requirements metFreshly Batch Inventory handles protected customer data under Shopify's requirements for encryption, retention, and staff access. Every app implements the mandatory privacy webhooks.
Australian Privacy Principles
SupportedOur DPA documents the reasonable steps for APP 8 cross-border disclosure, and our notification commitment supports the Notifiable Data Breaches scheme.
Security controls
These safeguards are in place today. Our security practices page covers each one in detail.
Encryption
- TLS 1.2 or higher on every connection, including to the database and Redis
- AES-256 encryption at rest for database storage
- OAuth tokens encrypted again at the application level
- Secrets kept in platform config stores, never in source code
Access control
- MFA enforced on GitHub, Google Workspace, and every infrastructure account
- Production access limited to our developers, under least privilege
- Quarterly access reviews across every system touching customer data
- Same-day identity suspension when someone leaves
Secure development
- Every change merged by reviewed pull request to a protected branch
- Brakeman and bundler-audit run in CI on every change
- Dependabot fix SLAs of 7 days for critical and 30 days for high issues
- Production customer data is never used in development or test
Infrastructure and backups
- Managed platforms only, with no office servers or on-premise production
- Hosting providers hold their own SOC 2 or ISO 27001 attestations
- Point-in-time recovery plus daily backups for our Postgres database
- Annual restore test, with the result kept as evidence
Incident response
- Written plan with severity levels and a containment runbook
- Affected merchants notified within 72 hours of a confirmed breach
- Blameless post-mortems within five business days
- Annual tabletop exercise against the plan
People
- Reference checks for every employee and contractor
- Security policies signed before any access is granted
- Security training within 30 days of starting, then annually
- Additional annual secure development training for developers
Control register
16 controls mapped to SOC 2 criteria, grouped by category.
Data handling by app
Each app collects only the data it needs. Open an app to see what it stores and why.
Bundles
Product bundling for Shopify stores. Merchants build bundles from their catalog; the app manages bundle configuration, pricing, and inventory sync.
Customer data
No end-customer PII
Data handling
Freshly Batch Inventory
Batch and expiry-date tracking for Shopify inventory, including lot traceability for recalls.
Customer data
Stores customer PII
Data handling
Simple Discounts
Discount management for Shopify stores, built on Shopify's discount APIs.
Customer data
No end-customer PII
Data handling
Documents
Public pages are open to everyone. Full policy texts, control detail, and the named subprocessor list are shared on request.
-
Security practices
Hosting, encryption, access control, and incident response.
-
Security FAQ
Answers to common security review questions.
-
Controls
16 control names by category.
-
Published policies
5 policy summaries.
-
Subprocessors
9 subprocessors by category.
-
Data Processing Agreement
Our DPA with Standard Contractual Clauses, countersigned on request.
Running a security review?
Send your questionnaire to security@freshlycommerce.com. Most answers are already on this site, and our team will fill in the rest.