Install freeSecurity at Pandectes
Our apps run on every page of your store and handle your customers’ consent. Here is how we keep that safe, and how you can check it for yourself.
- Shopify app security checks passed
- Independently audited
- Hosted in the EU
Shopify’s app security checks, passed on every app
Shopify now checks how securely each app connects to a store. Every Pandectes app on the Shopify App Store passes all of them, and you can see it in your own admin: open Settings, then Apps, and choose a Pandectes app.
Expiring access tokens
Our access to your store expires every hour and has to be renewed, so a token that leaked would stop working on its own.
Shopify’s documentationEnforced IP restrictions
Your store’s data can only be reached from our own servers. A request from any other address is rejected by Shopify, even with a valid token.
Shopify’s documentationApp security checks
Shopify verifies both and shows the result in your admin, so you don’t have to take our word for it.
Shopify’s documentation
How we protect your store and its data
Independently audited
To become a Shopify Plus Partner, Pandectes passed a security audit by an independent third-party vendor.
Shopify Plus PartnerHosted in the EU
Our apps run on Heroku in Europe and store data with Amazon Web Services in Ireland. Every provider that processes data for us is listed, with where it does so.
Sub-processors listEncrypted and logged
Data is encrypted in transit and at rest, and access to the systems that process it is logged and monitored.
Minimal data, deleted on time
Shopper IP addresses are stored masked. A store’s consent logs and account data are deleted 30 days after the app is uninstalled, and Shopify’s data-deletion requests are honoured automatically.
A Data Processing Agreement
Our DPA sets out how we process personal data on your behalf and the technical and organisational measures behind it.
Data Processing AgreementResponsible disclosure
Security researchers can report a vulnerability to us through our vulnerability reporting program.
Report a vulnerability
Live system status
The status of our apps and services, any incident as it happens, and past uptime are public.
View system statusSecurity questions? Contact us.