Security & Data Protection

Vayu Sharma Shopify apps · Last updated 26 September 2026

This page describes how the Shopify apps published by Vayu Sharma protect merchant and customer data, and what we do if something goes wrong. It complements our Privacy Policy.

1. Data we handle

• Customer personal data is not stored. Apps that check checkout details (for example Vayu Address Validator) do so inside Shopify Functions, which run on Shopify's infrastructure at checkout time. The result is only "allowed" or "blocked with a message"; names, phone numbers and addresses are never sent to, stored on, or logged by our servers.
• What our servers store: the store's access token and session needed to run the app, and the merchant's own app settings. Settings shown on the storefront are stored as Shopify metafields.
• Minimum data: each app requests only the Shopify permissions it uses, and each protected field only for the rule that needs it.

2. Data loss prevention

• Data minimisation first: no customer personal data is kept, so there is nothing of that kind to lose or leak.
• Production runs on a dedicated Google Cloud virtual machine. Test data is kept separate: all testing uses Shopify development stores and never real stores or real customer data.
• Daily snapshots of the production disk are taken automatically and kept for 7 days, stored encrypted by Google Cloud.
• Secrets (API keys) are stored only in restricted environment files on the server (readable by the service only), never in source code.
• All traffic between Shopify, merchants and our servers is encrypted with HTTPS (TLS). Disks and backups are encrypted at rest by Google Cloud.

3. Access control and logging

• Production access is limited to the developer, using SSH keys (no passwords) and Google accounts.
• Administrative access to the cloud project and the server is logged: Google Cloud Audit Logs record console and API access, and the server's system journal records every SSH login.
• Access to merchant data is only used to operate the app or to answer a merchant's support request.

4. Retention and deletion

• When a store uninstalls an app, its sessions are deleted. Shopify's mandatory privacy webhooks (customer data request, customer redact, shop redact) are implemented; shop data is deleted on shop redact.
• Backups expire automatically after 7 days.

5. Security incident response

1. Detect and contain: on any sign of a security problem (unexpected access, leaked secret, compromised account), access is cut immediately: affected keys and tokens are rotated, the server or app is isolated or taken offline if needed.
2. Assess: determine what happened, which stores and which data could be affected, using the audit and system logs.
3. Notify: affected merchants and Shopify are notified without undue delay and within 72 hours of becoming aware of an incident that affects personal data, with what happened, what data was involved and what we are doing.
4. Recover: restore from clean backups, fix the cause, and redeploy.
5. Review: record the incident and the changes made so it does not happen again.

Security contact: magentodeveloper1993@gmail.com (emergency phone on file with Shopify).