Security & Data Protection

This page describes how we protect the personal data handled by our Shopify apps (currently Kaison B2B Line Sheets). It complements our privacy policy, which lists what we collect and why.

1. Data minimisation

The app reads only the Shopify data it needs to build a line sheet and create a draft order (products, prices, B2B companies and catalogs, the draft order it creates). It does not read customer names, addresses or phone numbers from your store. The only personal data stored on our side is what a buyer types into an order link (name, company, email, phone, message) and the merchant's store contact details used for the line sheet header. Full details are in the privacy policy.

2. Encryption

• In transit: all traffic to the app, the buyer order pages and the Shopify API uses HTTPS (TLS). There is no plain-HTTP endpoint.
• At rest: buyer contact details (name, company, email, phone, message) and the store's API access tokens are encrypted with AES-256-GCM before they are written to the database. The encryption key is held outside the database and is never written to logs or source code.
• Backups: database backups are taken daily, encrypted with AES-256 and kept for 14 days; the backup key is stored separately from the backups.

3. Retention

4. Access control and logging

• Kaison Global FZE is a single-operator company. One person has access to production systems; there are no shared or contractor accounts.
• Servers accept SSH key authentication only (password login disabled), behind a firewall that exposes only HTTPS and SSH. Operating-system security updates are applied automatically.
• The Shopify Partner account and all accounts used to operate the service are protected with strong, unique passwords and two-step verification.
• Every access to buyer records by a merchant, by a compliance webhook or by an operator is written to an append-only application log with the time, the store, the action and the record IDs. Log entries never contain the personal data itself.

5. Test and production separation

Development uses a separate Shopify development app, a Shopify development store with made-up products and buyers, and a local database. No production merchant or buyer data is copied into test systems.

6. Data loss prevention

• Daily encrypted backups (section 2) and a documented restore procedure.
• Least-privilege Shopify API scopes: read products, companies, customers and publications; write draft orders only.
• No third-party analytics, advertising SDKs or data brokers. Data leaves our systems only to Shopify (to create draft orders) and to the merchant (their own records). Customer data requests are answered through an encrypted export handled by the operator.
• Dependencies are kept current and the app is rebuilt from a pinned, reproducible container image.

7. Security incident response

1. Report. Anyone can report a suspected incident or vulnerability to support@kaisonapps.com (subject "Security"). We acknowledge reports within two business days.
2. Contain (within 24 hours of becoming aware). Rotate affected credentials and API secrets, isolate or take the affected service offline if needed, preserve logs.
3. Assess. Determine which stores and which records were affected, using the access logs and backups.
4. Notify (within 72 hours of confirming a breach of personal data). Email every affected merchant with what happened, which data was involved, what we have done and what they should do; notify Shopify as required by the Shopify Partner Program Agreement; assist merchants with their own notifications to buyers or authorities.
5. Fix and review. Remove the cause, verify the fix, and record the incident, timeline and follow-up actions.

8. Sub-processors

9. Third-party audits

We have not undergone a third-party security audit or certification (such as SOC 2) at this time. This page will be updated if that changes.

10. Changes

Changes to this page are dated at the top. Questions: support@kaisonapps.com.