Security and Data Protection Policy

Taakid, by Amrania Labs · Last updated: 3 October 2026 · Contact: hello@amrania.com

This policy describes how Taakid protects the personal data of merchants' buyers. It complements the privacy policy, which lists what the app reads and why.

1. Data minimisation

• The app reads a buyer's name, phone number and shipping city and country from Shopify only when the merchant opens the confirmation board or an order, and only to show them and build the confirmation message.
• None of these is stored in readable form. The only buyer identifier kept is a keyed one-way hash of the phone number (HMAC-SHA-256 with a server secret), which cannot be turned back into the number.
• The app never reads email addresses, street addresses, payment data or browsing behaviour.

2. Storage and encryption

• Data is stored in a managed PostgreSQL database at Railway Corp., reachable only over Railway's private network by the app itself. Railway holds a SOC 2 Type II report and encrypts stored data at rest.
• All traffic between Shopify, the app and the merchant's browser uses TLS. Webhooks from Shopify are accepted only with a valid HMAC signature.
• Secrets (API credentials, the hashing key, the database URL) are held as encrypted environment variables at the host, never in source code or logs.

3. Backups

• Every night the database is exported, compressed and encrypted with AES-256-GCM using a key held only by the app's operator and the backup job, then stored in a private repository. The 30 most recent backups are kept; older ones are deleted automatically.
• Login sessions (Shopify access tokens) are not included. Backups therefore hold only settings, order statuses and phone hashes, none of it readable buyer personal data, and encrypted on top of that.
• Restores are tested by decrypting a backup and checking it against the live database.

4. Retention and deletion

• Order statuses and refusal counters are kept while the app is installed, so the merchant keeps their history.
• customers/redact requests delete that buyer's hash, counters and order records. Uninstalling deletes sessions and plan data at once; shop/redact 48 hours later deletes everything else for the store.

5. Access control

• Production systems and data are accessed only by the app's developer, the sole member of staff, and only to operate, support or fix the app.
• Accounts that can reach production (Shopify Partners, Railway, GitHub) use unique strong passwords or passkeys, with two-factor authentication wherever the provider offers it.
• Personal data is never exported, copied to personal devices, or shared with anyone other than the sub-processors listed in the privacy policy.

6. Logging

• Every read of buyers' personal data writes an audit line recording the store, the purpose (board, order page, outcome), the number of orders and the field names. The values themselves are never logged.
• The app's logs, and the hosting provider's account activity logs, are kept by Railway.

7. Test and production data

• Development and testing use Shopify development stores with fictional buyers only. Real merchants' or buyers' data is never copied into development or test environments.

8. Data loss prevention

• Readable personal data is never written to the database, logs, backups or analytics, which removes most of what could leak.
• Nightly encrypted backups protect against loss or corruption; deploys are built from version-controlled source; secrets are rotated if exposure is suspected.

9. Security incident response

1. Detect and contain: on any sign of unauthorised access, rotate the affected credentials and the hashing key, revoke sessions, and take the affected component offline if needed.
2. Assess: use the access log and the host's activity logs to establish what data and which stores were affected.
3. Notify: inform affected merchants and Shopify without undue delay, and in any case within 72 hours of confirming an incident that affects personal data, with what happened, what data was involved and what was done.
4. Recover and review: restore from backup if needed, fix the cause, and record the incident and the changes made.

10. Audits

The app has not had a third-party security audit of its own. Its hosting provider, Railway, holds a SOC 2 Type II report.

Contact

Report a security concern to hello@amrania.com. We acknowledge reports within 2 business days.