This page describes the controls used to protect merchant data in the app. This page describes current security practices and is provided for informational transparency. It does not create warranties, guarantees, or binding service-level commitments beyond those stated in the Terms of Service. Security measures may evolve as threats, technology, and the app's scale change. The warranty disclaimers and liability limitations in the Terms of Service apply to all security-related claims.
Last updated June 21, 2026.
Access Control
Dashboard pages and dashboard APIs require authenticated access and tenant workspace authorization. Internal job routes require signed tenant-scoped operation credentials or a fenced legacy compatibility secret.
Human support access is denied by default. Workspace owners and admins must grant scoped, time-limited support access before support can inspect data-quality traces for a case. Grants and revocations are recorded in the tenant audit log.
The settings support form explains the data-quality examples merchants should provide: order IDs, return or RMA IDs, SKU/product, date range, reporting month, expected result, actual result, and redacted screenshots or export snippets when relevant.
Shopify lifecycle and compliance webhooks are public endpoints by design, but they verify Shopify HMAC signatures before mutating install state or recording privacy request ledger rows.
Encryption
Public app traffic uses HTTPS/TLS. Railway public networking provides automatic SSL certificates for hosted app domains, and Railway private networking uses encrypted WireGuard tunnels for service-to-service traffic inside a project.
Tenant integration credentials, including Shopify and vendor secrets, are encrypted server-side with AES-256-GCM before being stored. Runtime secret values remain server-side and are not exposed to browser clients.
Production database and backup storage are managed through infrastructure providers with database, access-control, and backup lifecycle controls reviewed as part of merchant onboarding readiness.
Data Minimization
The app requests the minimum Shopify data needed for return-rate analytics. Direct customer name, email, phone, and address fields are not part of the v1 dashboard, API, exports, or logs.
Connected return providers may supply customer identifiers or contact fields in raw operational payloads. Those fields are restricted, retained only as documented in the Privacy Policy and Data Processing Addendum, and included in privacy deletion workflows.
Raw integration payloads are treated as sensitive diagnostic evidence and should be limited to replayability, support, and reliability needs. Audit metadata records scope and counts rather than raw support messages, credentials, tokens, or unnecessary customer personal data.
Privacy data-request exports are generated as short-lived tenant-scoped artifacts with expiry metadata and audit coverage. Dashboard and API exports are streamed where possible rather than retained as durable artifacts.
Support cases should not include passwords, access tokens, customer payment details, full customer message bodies, or unnecessary personal data.
Unattributed partial refunds and diagnostic records are tracked separately from the main KPI numerator to avoid overcounting and unsupported conclusions.
Incident And Deletion Handling
Suspected unauthorized access should be reported to app support. Credentials can be revoked, integrations disabled, and scheduler credentials rotated without deleting the merchant workspace.
If Returns Intelligence identifies or suspects a security incident involving merchant data, notification and response will follow the breach notification procedures described in the Data Processing Addendum.
Deletion and anonymization requests are handled through the privacy request ledger, protected fulfillment jobs, and the retention policy in the Data Processing Addendum.
Responsible Disclosure
If you discover a potential security vulnerability in the app, please report it to [email protected]. Please do not publicly disclose the vulnerability until we have had a reasonable opportunity to address it. We appreciate responsible disclosure and will acknowledge receipt within 48 business hours.