Security and incident response

Safeguards

Data minimisation: customer data only passes through to the Shopify order and is not stored by us.
Encryption: all traffic uses TLS. The database and its backups are encrypted at rest. Marketplace credentials are additionally encrypted with AES-256-GCM.
Backups: the database is backed up continuously with point-in-time recovery.
Access: authorised staff only, with individual accounts, a password manager and two-factor authentication on all operational accounts (Shopify, hosting, code repository).
Logging: events involving orders, credentials and GDPR requests are logged and kept for 12 months.
Test and production: development and testing use Shopify development stores with test data. Real customer data is never copied to test.
Retention: order lines are deleted after 12 months, and all store data within 48 hours of uninstall.

Detect and contain: on a suspected incident, affected credentials and accounts are locked immediately (rotate secrets, revoke tokens, pause sync).
Assess: within 24 hours we determine which stores and data are affected and the risk to data subjects.
Notify: affected merchants are informed without undue delay and within 72 hours, with what happened, which data is affected and what has been done. Shopify is notified under the Partner Program Agreement. Where required, the incident is reported to the Swedish Authority for Privacy Protection (IMY).
Remediate: the cause is fixed, backups restored if needed and the fix verified.
Document and learn: every incident is documented with timeline, root cause and improvements.

Email info@torgly.com. We respond within one business day.