Security Overview

Last updated: September 3, 2026

Security posture for V1: minimize protected data, avoid raw PCD persistence, encrypt Shopify credentials at rest, use TLS in transit, verify Shopify webhook HMACs, and delete shop credentials when access ends.

Encryption

In transit: Shopify and public YEEDOOR endpoints use HTTPS/TLS.
At rest: Shopify access and refresh tokens are encrypted using AES-256-GCM before Prisma session persistence.
Key handling: production requires a dedicated SESSION_ENCRYPTION_KEY supplied through the deployment environment/secret manager and not committed to source control.

Protected customer data

Raw Shopify Level 1 protected customer/order data is processed transiently and is not persisted in the V1 database. The app does not request the protected Name, Address, Email, or Phone fields in V1.

Authentication and tenant boundaries

Shopify OAuth and session authentication scope access to the merchant's authorized store. Shop-scoped data and credentials are deleted when the installation ends. Future persistent business-data models must remain tenant-scoped by Shopify shop identity.

Webhook security

Mandatory privacy webhook endpoints verify the raw request body using the Shopify X-Shopify-Hmac-Sha256 signature. Invalid signatures receive HTTP 401.

Logging and secrets

Application code is designed not to log Shopify access tokens or raw protected customer data. Production secrets must be provided through the deployment environment and rotated if compromise is suspected.

Incident response

Our incident process includes containment, credential/session revocation, secret rotation, investigation, remediation, and merchant/authority notification where legally required.

Contact

Security issues may be reported to aiken@yeedoor.com. Please avoid including customer personal data in the initial report.