Security at Dollarlabs

1. Overview

Dollarlabs is a small team that builds apps for the Shopify App Store. This page describes, in plain terms, how we handle merchant and customer data and how to report a security issue to us. It is a statement of practice, not a certification. We do not currently hold SOC 2, ISO 27001 or similar third-party attestations.

2. Shopify platform

• Our apps install through Shopify OAuth and request only the access scopes each app needs to function. Merchants see and approve those scopes at install time and can uninstall at any time.
• Store data is read and written through Shopify's APIs. We do not receive payment card details; checkout and payment are handled by Shopify.
• Our apps implement Shopify's mandatory privacy webhooks (customer data request, customer data erasure and shop data erasure) and honour them.
• Our apps go through Shopify's App Store review, which includes checks on permissions, data handling and webhook verification.

3. Data handling

• We store the minimum data an app needs to work: the store identifier, the access token Shopify issues, app configuration, and the records the app operates on.
• All traffic between Shopify, our servers and merchant browsers is encrypted with TLS.
• When a merchant uninstalls an app, the store's access token is invalidated by Shopify and we delete the store's data in line with the shop-erasure webhook and our privacy policy.

4. Infrastructure and access

• Our apps are hosted in the EU region.
• Production access is limited to the people who operate the apps and requires individual credentials. Secrets are kept out of source code and injected at deploy time.
• We keep centralised logs and monitoring for our services so that faults and unexpected behaviour are visible to us.

5. Reporting a vulnerability

If you believe you have found a security issue in one of our apps or this website, please email [email protected] with a description and steps to reproduce. We will acknowledge your report, investigate it, and keep you informed of what we do about it. Please give us reasonable time to fix an issue before disclosing it publicly, and do not access or modify data that is not yours.

6. Contact