Security & Incident Response

Last updated: 13 October 2026

1. Technical measures

• Encryption in transit: all traffic uses HTTPS (TLS) with automatically renewed certificates.
• Encryption at rest: the database runs on a LUKS2 (AES-XTS, 512-bit key) encrypted volume. Platform API keys and tokens are additionally encrypted in the database with AES-256-GCM.
• Encrypted backups: nightly database backups are encrypted with age (X25519) before they are written. They are copied to separate storage in another data centre. The decryption key is not stored on the servers.
• Data minimisation: contact data is normalised and SHA-256 hashed before it is sent to advertising platforms. The App only reads the Shopify data it needs.
• Retention: browsing events are kept for 6 months. Purchases and sign-ups are kept for 13 months, and delivery logs for 90 days (full request bodies for 7 days). Access logs are kept for 13 months.
• Separation: development and testing use separate databases with fictional data only; production data is never copied to development.
• Infrastructure: EU hosting (Hetzner, Germany). The firewall only allows web traffic and key-based SSH. Automatic security updates and brute-force protection are enabled, and the database is not reachable from the internet.

2. Organisational measures

• Access to production systems and data is limited to the Provider's authorised administrator.
• All administrative accounts (Shopify Partners, hosting, domain) use unique strong passwords from a password manager and two-factor authentication.
• Views and exports of personal data in the App (visitor profiles, event logs, live activity, CSV exports) are recorded in an access log with user, time and IP address.
• The service is monitored for availability; logs are reviewed when anomalies occur.

3. Incident response policy

1. Detect: availability monitoring, application and server logs, and reports from merchants or Shopify.
2. Triage (within 4 hours of detection): confirm the incident, assess which stores and data are affected, and assign severity.
3. Contain: revoke or rotate affected credentials and keys, isolate affected systems, and block malicious access.
4. Notify: inform affected merchants without undue delay and at the latest within 48 hours with the facts known. Inform Shopify where required by the Partner terms, and support merchants with their own notifications to authorities and customers (GDPR Art. 33/34).
5. Recover: restore service, and data from encrypted backups if needed; verify integrity.
6. Review: document the root cause, timeline and measures taken, and implement improvements. Incident records are kept for at least 3 years.

4. Reporting a vulnerability

Please report security issues to info@crotechcreators.com. We acknowledge reports within 2 business days.

Creators it consulting d.o.o., Croatia