Data privacy
Merchant and customer information is handled securely, and the application stores only what a quotation workflow actually needs.
- No customer payment data is stored — checkout stays with Shopify
- Quote records hold only the fields required to price and fulfil a request
- Data lives in your own database instance, under your control
- No analytics or telemetry is sent back to FIDE Labs
Secure hosting
Deployments run on secure cloud infrastructure with encryption in transit and reliable, reproducible hosting.
- HTTPS enforced end to end, with HSTS in the production config
- Deploy to Vercel, Fly.io, or Docker with the included pipeline
- Secrets read from environment variables, never committed to the repository
- Database connections are TLS-encrypted by default
Webhook security
Every inbound Shopify webhook is verified before the application acts on it.
- Shopify webhook verification on all registered topics
- HMAC signature validation using your app secret
- Requests failing validation are rejected with a 401 and logged
- Session tokens and OAuth flows follow Shopify authentication best practice
Source code security
A production-ready architecture written with secure coding practices and no hidden behaviour.
- Parameterised database access through Prisma — no raw string queries
- Input validation and output escaping across routes and forms
- No obfuscated bundles, tracking scripts, or licence phone-home
- Regularly maintained, with fixes shipped to all licence holders
Dependencies
The dependency tree is deliberately small and actively monitored.
- Trusted, widely-used packages with active maintenance
- Regular upgrades on a scheduled release cadence
- Security patches shipped promptly when advisories land
- Automated dependency and vulnerability monitoring in CI
Privacy & compliance
A GDPR-aware implementation that leaves customer data in the merchant’s hands.
- Shopify GDPR webhooks implemented: data request, redact, and shop redact
- Merchant-controlled customer data with export and deletion paths
- Data minimisation and retention practices built into the schema
- Clear privacy documentation you can adapt for your own brand
