Security policy

1. What we hold and why

We process only the personal data Cartnio needs: shoppers’ names, email addresses and order details (to send review requests, verify reviews and run loyalty programmes), and merchants’ account and billing details. We don’t sell personal data or use it for anything else. The full list, purposes and retention periods are in our privacy policy and data processing agreement.

Personal data is deleted when it’s no longer needed: within 30 days of an account closing, immediately when a merchant deletes it, and automatically when Shopify sends a customer or shop deletion request.

2. Access control and passwords

• Only named Cartnio staff can access production systems or customer data, and only when needed to run or support the service. Today that is the founder only. Access is removed the day someone no longer needs it.
• Every staff account on our providers (Supabase, Vercel, GitHub, Stripe, Shopify Partners, Resend and email) uses a unique password of at least 12 characters, kept in a password manager, with two-step verification turned on.
• Cartnio accounts require passwords of at least 10 characters with upper and lower case letters and a number.
• Each merchant can only see their own data. This is enforced in the database (row-level security), not only in the app.
• Secret keys (database service key, Shopify and Stripe secrets) live only in our hosting provider’s encrypted environment settings, never in code, the browser or merchants’ themes.

3. Encryption

All traffic uses TLS (HTTPS). The database, file storage and their backups are encrypted at rest (AES-256) by our hosting providers. Shopify storefront requests are verified with Shopify’s signature before any customer data is read.

4. Test and production data

• Production data stays in production. It is never copied into development or test environments.
• Automated database tests run on a temporary local database built from our schema, which is thrown away after each run. The test runner refuses to connect to any other database.
• Manual testing uses development stores (for example Shopify development stores) filled with made-up customers, and is removed when finished.

5. Data loss prevention

• Backups: the database is backed up daily and backups are kept for at least 7 days, encrypted, so data can be restored after a mistake or failure.
• Least data out: customer personal data can only leave Cartnio through features merchants use for their own store (their dashboard, exports and the integrations they connect). Our team console has no bulk export of shoppers’ personal data.
• Every view is logged: when Cartnio staff view a store’s customer data or support conversations, it is recorded (see below).
• Code and secrets: every change is automatically tested before release, dependencies are pinned to exact versions, and secret keys are never stored in the code repository.
• Devices: staff devices use full-disk encryption, a screen lock and up-to-date software.

6. Access logging

Every time Cartnio staff view a store’s details, customer lists, support tickets or system health, the console records who, what and when in an access log that can’t be edited from the app. Our hosting providers also keep request and database logs. We review the access log at least monthly and investigate anything unexpected.

7. Security incident response

A security incident is anything that could expose, change or destroy personal data without permission: a leaked key, unexpected access, a vulnerability that’s being exploited, or lost data. The founder is the incident lead and decision-maker.

Severity

• Critical: personal data has been, or is very likely to have been, accessed or lost.
• High: a weakness or leaked credential that could expose personal data, with no sign yet that it has.
• Low: a security bug with no route to personal data.

What we do

1. Contain straight away: rotate any exposed keys, revoke tokens, disable affected accounts or features, and block the cause.
2. Preserve evidence: save the relevant logs and write a timeline of what happened and what we did, as it happens.
3. Assess: which data, which merchants and how many people are affected, and the likely harm.
4. Notify: for critical incidents, affected merchants without undue delay and within 48 hours of confirming it, so they can meet their own legal duties. We tell Shopify (and any other affected platform) as their partner terms require, and help merchants with regulator or customer notices.
5. Recover: fix the cause, restore data from backups if needed, and check it’s resolved.
6. Review: within 14 days, write up what happened and what we’re changing to stop it happening again.

To report a security problem, email hello@cartnio.com with “Security” in the subject. We reply within two working days.

8. Keeping this up to date

We review this policy at least every six months and whenever our systems change. Last reviewed 14 October 2026.