Trust Center
Resources
Every document a security reviewer can read here. Open items are public, and locked items are shared on request.
Security program
Open to everyone
-
Security practices
Hosting, encryption, access control, secure development, and incident response.
-
Controls
Control names are public. Detail and SOC 2 criteria are shared on request.
-
Security FAQ
Answers to common security review questions.
Policies
-
Information Security Program Overview
The master policy describing Freshly Commerce's security program, its scope across our three Shopify apps and vendors, who owns it, and how it is governed and reviewed.
-
Data Classification, Retention & Deletion Policy
How we classify merchant and customer data, where each class may live, how long we keep it, and how deletion requests and Shopify redaction webhooks are honored.
-
Privacy & Data Protection Policy (GDPR / APP / PIPEDA)
Our role as processor of merchant customer data, how Shopify's mandatory privacy webhooks drive data subject requests, international transfer posture, and DPA availability.
-
Vendor & Third-Party Risk Management Policy
How we evaluate vendors before they touch merchant data, review them annually, and keep the public subprocessor list in sync with the internal register.
-
Incident Response Plan
How security incidents are declared, contained, and resolved, and our commitment to notify affected merchants within 72 hours of confirming a breach of their data.
Privacy and subprocessors
-
Subprocessor list
Categories are public. The named list is shared on request.
-
Data Processing Agreement
Our DPA with Standard Contractual Clauses, countersigned on request.