Security & Incident Response

Last updated: 29 September 2026

This page describes how AppSaaz Labs protects the personal data that AppSaaz Returns & Exchanges ("the App") processes for Shopify merchants and their customers, and what we do if something goes wrong. It complements our Privacy Policy.

How we protect data

• Least data: we request only the customer fields the returns workflow needs (name, email, phone and address). Phone numbers and addresses are read from Shopify when needed and are not stored.
• Encryption: all traffic uses HTTPS (TLS). The database is stored on an encrypted disk, backups are kept in encrypted storage, and bank details for Cash-on-Delivery refunds are additionally encrypted with AES-256-GCM before storage.
• Access control: only the AppSaaz Labs engineers who run the service can reach production systems. Every account used to run the App (Shopify Partners, hosting, email and code hosting) uses a strong, unique password and two-factor authentication. Inside the App, merchants can limit their own staff by role.
• Access logging: the App records each time a merchant's staff opens a customer's request, views bank details or exports requests, with the staff account and time. Logs are kept for one year.
• Separate environments: development and testing use separate databases and test stores; production data is never copied into them.
• Backups and recovery: the database is continuously replicated to encrypted storage so it can be restored after a failure.
• Retention and deletion: data is kept while the App is installed and deleted when Shopify sends its data-deletion requests (for a customer, or for the whole store after uninstall).

Incident response policy

A security incident is any event that may have exposed, altered or destroyed personal data the App processes, or taken the service down unexpectedly.

1. Report: anyone can report a suspected incident or vulnerability to support@getsaaz.app. Reports are acknowledged within one business day.
2. Assess: we confirm what happened, which stores and data are affected, and how serious it is.
3. Contain: we stop the cause, for example by rotating keys and access tokens, disabling affected features or blocking access, and preserve logs for investigation.
4. Notify: if personal data may have been exposed, we notify affected merchants and Shopify without undue delay, and within 72 hours of confirming the incident, with what happened, what data was involved and what we are doing about it. Merchants remain responsible for notifying their own customers where the law requires it; we give them the information they need.
5. Recover: we restore normal service, from backups if necessary, and confirm the data is intact.
6. Review: within two weeks we record the root cause and the changes that prevent it happening again.

This policy is reviewed at least once a year and after any incident.

Contact

Security questions or reports: support@getsaaz.app.