Is Freshly Commerce SOC 2 certified?

Not yet. Our controls are SOC 2-aligned and a formal audit is planned; we do not claim certification before we have it.

How do I get access to the full policies and subprocessor list?

Request access from the Trust Center. An administrator reviews each request, and approved reviewers sign in with an emailed link under a confidentiality agreement.

Security FAQ | Freshly Commerce Trust Center

Q: Where is merchant data hosted?

In the United States, on managed platforms running on AWS infrastructure (us-east-1) for the application tier and database.

Q: Do Freshly Commerce apps store end-customer personal data?

Mostly no. Bundles and Simple Discounts store no meaningful end-customer PII. Freshly Batch Inventory stores customer names, emails, and order details because lot traceability for recalls requires them; it is treated as our highest-sensitivity app.

Compliance

Do you have a SOC 2 report?

Not yet. We run a SOC 2-aligned security program (written policies, quarterly access reviews, annual training, automated evidence collection) mapped to the Trust Services Criteria for Security and Confidentiality. A formal audit is on our roadmap. Our security practices page and policies describe the program in detail, and we are happy to walk you through it.

Are you GDPR compliant?

We act as a processor for your customers' data and support your GDPR obligations. We honor Shopify's mandatory privacy webhooks (customers/data_request, customers/redact, shop/redact) within 30 days, offer a DPA with SCCs, and minimize the data each app collects. We commit to notifying you within 72 hours of confirming a breach.

What about Australian Privacy Principles (APP) compliance?

For Australian merchants, our DPA and this Trust Center document the "reasonable steps" relevant to APP 8 cross-border disclosure (your data is processed in the US). Our 72-hour merchant notification commitment supports your obligations under the Notifiable Data Breaches scheme.

Do you comply with Shopify's protected customer data requirements?

Yes. Freshly Batch Inventory processes protected customer data under Shopify's requirements (encryption, retention limits, and staff access controls), and all our apps implement Shopify's mandatory privacy webhooks. Meeting these requirements is a condition of operating on the platform.

Do you offer a DPA?

Yes. A standard Data Processing Agreement, including Standard Contractual Clauses for EU transfers and our subprocessor list, is available to any merchant on request at security@freshlycommerce.com.

Hosting and data

Where is our data hosted? Can you host in the EU?

Data is hosted in the United States on managed platforms running on AWS infrastructure (us-east-1) for the application tier and database. The named providers are on our subprocessor list, shared on request. We do not currently offer EU hosting. For EU and UK merchants, transfers are covered by Standard Contractual Clauses included in our DPA.

Is data encrypted in transit and at rest?

Yes. We use TLS 1.2 or higher on all connections, including our own connections to the database and Redis. At rest, database storage is encrypted with AES-256, and stored OAuth tokens are additionally encrypted at the application level.

What customer data do your apps actually store?

It varies by app, and each app has its own data handling page in this Trust Center. Freshly Batch Inventory stores customer names, emails, and order details because batch and expiry lot tracking and recalls require them. Bundles and Simple Discounts store merchant, product, and configuration data with no meaningful end-customer PII.

How long do you keep data, and what happens when we uninstall?

Data is retained while your subscription is active. On uninstall, Shopify's shop/redact webhook triggers deletion of your shop's data within 30 days. Backups age out within 35 days. You can also request deletion at any time via support, with a 30-day SLA.

How are backups handled?

Our Postgres system of record has continuous point-in-time recovery (PITR) plus daily backups, retained no longer than 35 days. We run an annual restore test to a scratch cluster and keep the result as evidence. Our recovery point objective (RPO) is at most 24 hours, though PITR keeps it to minutes in practice. The recovery time objective (RTO) is at most 8 hours for Bundles and 24 hours for the other apps.

Access and people

Who at Freshly Commerce can access our data?

Production access is limited to our three developers, under least privilege, with MFA enforced everywhere and quarterly access reviews. Support staff see only what you share in support conversations plus the app's admin interface. No customer data is kept on employee laptops.

Do your staff undergo background checks and security training?

Yes. Reference/background checks are completed on hire, all staff sign our security policies before receiving access, and everyone completes security training within 30 days of starting and annually after that.

Incidents and testing

How quickly would you notify us of a breach?

We notify you without undue delay, and within 72 hours of confirming a breach involving your data. The notice includes the details you need for your own regulatory obligations.

Have you had any data breaches?

None to date. If that ever changes, the notification commitment above applies.

Have you had a penetration test?

We haven't had a formal third-party penetration test yet. One is planned ahead of our SOC 2 audit. Today we rely on automated external scanning (an annual OWASP ZAP baseline), Brakeman static analysis and bundler-audit in CI, and mandatory code review on every change. Dependabot monitors our dependencies, with fix SLAs of 7 days for critical and 30 days for high issues.

How do you secure your development process?

All code is merged by reviewed pull request to a protected branch, and CI enforces tests, Brakeman, and bundler-audit. Secret scanning with push protection keeps credentials out of code. Staging is separate from production, and production customer data is never used in development.

Vendors, AI, and reviews

Who are your subprocessors? Will you tell us if the list changes?

Subprocessor categories are public on the subprocessors page. The named list, with each provider's purpose and the data it processes, is shared on request. We commit to 30 days' notice before adding a subprocessor.

Do you use AI services, and is our data used to train models?

Yes, in limited ways. The Bundles app sends merchant product and catalog data (never end-customer PII) to OpenAI to generate bundle suggestions, and we use the Google Gemini API for image generation. Both run under API terms that exclude the data from model training. For development tooling we use Anthropic, with code and internal text only. Our Acceptable Use Policy prohibits placing customer personal data in any third-party AI tool.

Can you complete our security questionnaire?

Yes. Send it to security@freshlycommerce.com. Most answers are already on this page. For the rest, we keep an internal answer bank and usually turn questionnaires around quickly for a company our size.