Security
You're trusting us with the data that runs your Shopify store. Here's how we protect it.
Encryption
All data in transit is encrypted with TLS 1.2 or higher. All data at rest is encrypted using AES-256. Database backups are encrypted with separate keys held in a managed key vault.
Authentication
App access is brokered by Shopify OAuth. We never see, store, or have the ability to recover your Shopify password. Internal engineering access requires single sign-on plus hardware-token MFA.
Infrastructure
We run on managed cloud infrastructure. Production environments are isolated from development environments and from the data of other tenants. Production access is limited to a short list of engineers, logged, and reviewed monthly.
Sub-processors
We share data with the minimum number of third parties required to run the product. The current list is Shopify, your authorized destination platforms (Klaviyo, Mailchimp, Attentive, Meta, Google, TikTok, Reddit), our cloud provider, and our transactional email provider. It is published in our privacy policy. We notify customers in advance of any addition.
Vulnerability disclosure
If you believe you've found a security vulnerability in our service, email security@bythenumbersapp.com. We acknowledge reports within 1 business day and aim to triage and patch within 7 days for serious issues. We do not pursue legal action against good-faith researchers.
Incident response
If a security incident affects your data, we will notify you within 72 hours of confirming the impact, in line with GDPR requirements. The notification includes what happened, what data was affected, the remediation already taken, and what we're doing to prevent recurrence.
Compliance
We are a Shopify-listed partner and comply with the Shopify App Store privacy requirements. We process customer data as a data processor under GDPR. Our Data Processing Addendum is available on request from support@bythenumbersapp.com.
Reporting a concern
For privacy questions, contact support@bythenumbersapp.com or use our contact form. For security disclosures, use security@bythenumbersapp.com.