Our security program
Freshly Commerce builds three Shopify apps (Bundles, Freshly Batch Inventory, and Simple Discounts) used by merchants in North America, Europe, and Australia. We run a SOC 2-aligned security program: written policies covering the full Trust Services Criteria for Security and Confidentiality, annual staff acknowledgement and training, quarterly access reviews, and automated evidence collection. We do not yet hold a SOC 2 report. A formal audit is on our roadmap.
Security questions go to security@freshlycommerce.com.
Hosting and infrastructure
Our apps run entirely on managed cloud platforms; we have no office servers and no on-premise production systems. The application tier and our Postgres system of record run on AWS infrastructure in the US East (us-east-1) region. Each platform holds its own SOC 2 or ISO 27001 attestation covering the infrastructure layer. The named providers, and what each one processes, are on our subprocessor list, shared on request.
Encryption
In transit
We use TLS 1.2 or higher on all connections: merchant and customer traffic to our apps, our connections to the Shopify API, and internal connections to the database (sslmode enforced) and to Redis.
At rest
Database storage is encrypted with AES-256 and service disks are encrypted. Stored OAuth tokens are additionally encrypted at the application level using Rails column encryption. Application secrets live only in platform configuration stores, never in source code. Secret scanning with push protection enforces this.
Access control
- Least privilege: production access is limited to our three developers; support staff have support tooling only.
- Multi-factor authentication is enforced on GitHub (org-wide), Google Workspace (org-wide 2SV), Shopify Partners, and every hosting and infrastructure account.
- Access is reviewed quarterly across every system touching production or customer data, with every account individually decided and remediations closed within 14 days.
- Offboarding: identity suspended same-day, all other access revoked within one business day, credentials rotated.
- No customer data is stored on employee laptops; all devices use full-disk encryption with annual attestation.
Secure development
- All production code is merged by pull request to a protected branch with at least one reviewer approval; direct pushes are blocked.
- CI runs the test suite plus Brakeman static analysis and bundler-audit on every change; Dependabot monitors dependencies with fix SLAs of 7 days (critical) and 30 days (high).
- Staging is separate from production, and production customer data is never used in development or test.
- Shopify specifics: webhook HMAC verification on every incoming webhook, least-scope OAuth, and session token authentication for embedded apps.
Subprocessor management
Every vendor is recorded in a risk register with criticality, data shared, and an annual review. Before a new vendor touches customer data we verify their SOC 2/ISO posture, DPA availability, and MFA support. Our subprocessor list is generated from this same register, and we commit to 30 days' notice before adding a subprocessor.
Incident response
We maintain a written incident response plan with severity levels, a containment runbook, and blameless post-mortems within five business days. We commit to notifying affected merchants without undue delay, and within 72 hours of confirming a breach involving their data. This timeline aligns with GDPR Article 33 and the Australian Notifiable Data Breaches scheme. We run an annual tabletop exercise against the plan.
People
Every employee and contractor completes reference checks, signs our security policies before receiving access, and completes security training within 30 days of starting and annually thereafter. Developers complete additional annual training on secure development for Shopify apps. Offboarding follows a same-day checklist. Contractors work under NDA with time-limited access.
Data retention and deletion
App data is retained while your subscription is active. We implement Shopify's mandatory privacy webhooks and act on each within 30 days: shop/redact deletes your shop's data after uninstall, customers/redact deletes an individual customer's data, and customers/data_request returns a customer's data. Database backups age out within 35 days, so deletions propagate fully on that schedule. You can also request deletion at any time via support.