Security & Data Protection

Last updated: 1 August 2026

This page is POdraft's written security policy: what we collect, how it's protected, how long we keep it, and what we do if something goes wrong. It's the policy our Shopify Protected Customer Data access is built on.

Data we collect and why

• Shop domain and access token — issued by Shopify at install, used to read your product catalog and create draft orders on your behalf.
• Forwarded purchase-order emails — sender address, subject, and attachment content, used only to extract line items and match them to your catalog.
• Extracted customer name, email, and company — the minimum fields needed to attach a draft order to the right customer. We do not collect payment details, passwords, or any data beyond what a merchant's own forwarded PO already contains.

Encryption

All traffic to and from POdraft is served over HTTPS/TLS (enforced by Cloudflare Pages). Data at rest lives in Cloudflare D1, which encrypts data at rest on Cloudflare's underlying storage infrastructure. Shopify access tokens are stored per-shop and are never exposed to the browser or to any third party.

Access control

Only the merchant's own authenticated embedded-app session (verified via a Shopify session token on every request) can read that shop's data. There is no shared or cross-shop access, no admin UI that lists other merchants' data, and no third party is given access to the database. Internal access to production infrastructure (Cloudflare account, D1) is limited to the app's single operator and gated by account-level 2FA.

Data retention and deletion

Purchase-order records (the email metadata, attachment-derived text, and extracted line items) are automatically deleted 90 days after they were received, whether or not the merchant acted on them, via a lazy cleanup pass that runs on every inbound-webhook and app-load request. Audit-log entries follow the same 90-day window. Uninstalling the app deletes all data for that shop immediately — shop record, purchase orders, and access log — via Shopify's app/uninstalled and shop/redact webhooks. A customers/redact request deletes that specific customer's purchase-order records immediately. A customers/data_request is logged and the held records are forwarded to our support address so the merchant can fulfil the request.

Data loss prevention

• Least privilege — the Shopify OAuth scope set is limited to what draft-order creation needs (product/customer read, draft-order read/write); we never request scopes we don't use.
• Minimal extraction — only the fields needed to build a draft order (customer name/email/company, line items) are parsed out of a PO email; the rest of the message is not retained beyond the 90-day window above.
• No third-party sharing or resale — data is never sold, shared for advertising, or handed to any party outside the processing pipeline required to run the app (Cloudflare for hosting/storage, Resend for inbound-email delivery, Anthropic for one-time extraction of a forwarded email's contents).
• Idempotent, indexed deletes — retention and redaction both run as simple indexed DELETE statements, so cleanup can safely run repeatedly without side effects or partial state.

Staff access & password policy

All staff accounts with access to podraft infrastructure (hosting, database, source control, support mailbox) are required to use strong, unique passwords managed via a password manager, with two-factor authentication enabled wherever the provider supports it. Credentials are never shared or reused across services, and access is revoked immediately when no longer required.

Incident response

If a security incident is suspected:

1. Detect — via Cloudflare's request/error logging and alerting on the Pages project and D1 database (unusual access patterns, spikes in failed auth, unexpected data volume).
2. Contain — immediately rotate the affected API keys/secrets (Shopify app secret, Resend key, Anthropic key) and revoke any compromised access tokens.
3. Assess — determine which shops and data fields were affected using the access log and Cloudflare request logs.
4. Notify — affected merchants are notified via the support contact on file within 72 hours of confirming a breach, describing what happened and what data was involved.
5. Remediate — patch the root cause, deploy the fix, and run a post-mortem to prevent recurrence.

Contact

Report a security concern or data request via the support form.

← Back to POdraft