Last updated: October 2026
How Verdikx protects merchant data and the data of merchants’ customers. Everything on this page describes what the product does today. For what data we process and why, see the Privacy Policy; for our data processing terms, the DPA and the providers that process data for us, see the Trust Center.
Encryption
- All traffic to Verdikx uses HTTPS. Every response carries an HTTP Strict Transport Security header (max-age of two years), so browsers refuse to connect over plain HTTP.
- Shopify access tokens and the credentials of every service you connect (payment processors, help desks and others) are encrypted by our application with AES-256-GCM before they are stored, using a key that is held only by our servers.
- Verdikx API keys are stored only as SHA-256 hashes; the full key is shown to you once, when it is created.
Tenant isolation and access
- Merchant data lives in a Postgres database (Supabase) with row level security on tenant tables: each signed-in account can read and change only its own stores' records. Internal tables are reachable only by our servers.
- Two-factor sign-in with an authenticator app is available on every account. When it is on, it is enforced by the database itself, through a restrictive row-level policy (mfa_assurance_required) on every protected table and on file storage, not only by the web pages. Inside Shopify admin, sign-in is handled by your Shopify login.
- Requests are rate limited, and account changes are protected against cross-site request forgery by origin checks.
- Website sign-ins end after 24 hours without activity and after 30 days at most; store staff sign-ins end after 12 hours. Creating API keys or webhooks, changing two-factor sign-in, linking a login and deleting the account are for the store owner only and need a password or code entered in the last 10 minutes. API keys expire after a period the owner chooses, a year at most.
- Sign-in, sign-up, password reset and our public forms are protected against bots by Cloudflare Turnstile, which most people never see.
Shopify privacy and least privilege
- Verdikx subscribes to Shopify's mandatory privacy webhooks: customers/data_request (we build the customer's data export automatically), customers/redact (we delete or anonymise that customer's records) and shop/redact (we delete the store's data). Every Shopify webhook is verified by its HMAC signature before it is processed.
- When a store uninstalls Verdikx, Shopify revokes our access and billing stops. We turn off Autopilot, disconnect connected processors and help desks and delete their credentials, revoke API keys and pause outbound webhooks. The store's data is then deleted when Shopify sends its store deletion request (shop/redact), usually about 48 hours after uninstalling.
- We ask only for the Shopify permissions the features need, and restricted permissions only after Shopify approves them. The Privacy Policy lists every permission and what it is used for.
Card data
- Verdikx does not receive, process or store full payment card numbers. Where a store or payment processor provides them, we work only with the card brand, the BIN (first digits) and the last four digits, or a processor's card fingerprint. Blocklists refuse a full card number if one is typed in.
- Shopify stores pay for Verdikx through Shopify Billing. Workspaces that are not on Shopify pay by card through Stripe's hosted checkout and billing portal, and workspaces not on Shopify with a custom agreement can be invoiced through Stripe. In every case the payment provider handles the payment details and we never see them.
- Because full card numbers never reach Verdikx, our PCI DSS scope is minimal. We do not claim a PCI DSS certification.
AI and your data
- AI features call the OpenAI API with response storage turned off. Under OpenAI's API terms, API data is not used to train its models, and we do not train models on your data or your customers' data.
- Dispute drafts are written from a limited, de-identified set of order facts; customer names, email addresses, addresses and uploaded files are not sent. The Privacy Policy describes exactly what each AI feature receives.
Monitoring and application security
- Errors are reported to Sentry when error monitoring is configured. Before anything is sent, sensitive fields are dropped and email addresses, common phone number formats, card-like numbers, IBANs, tokens, secrets, IP addresses and URL query strings are masked.
- Our own server logs go through the same masking before they are written: email addresses, common phone number formats, IP addresses (IPv4 and IPv6), card-like numbers, IBANs and any field named like a token, secret, password, API key, cookie or authorization header.
- Uploaded files are checked by their content (magic bytes), not just their name, and stored under server-generated names in private storage.
- Responses send security headers that block MIME sniffing, limit framing to Shopify admin and restrict browser features we don't use.
Incident response
We follow a written incident response plan that covers detection, containment, eradication, recovery and a review after every serious incident.
- If a personal data breach affects your store’s data, we notify you without undue delay, and in any event within 72 hours of becoming aware of it, as our Data Processing Addendum (listed in the Trust Center) commits. The notice describes what happened, the data and people affected, the likely consequences and the steps we are taking, and we follow up as we learn more.
- We also meet our notification duties to Shopify as an app partner, and to regulators and individuals where the law requires it.
- The plan requires preserving the logs and records of every incident, and an exercise to rehearse it every year.
- To report a suspected incident or a security concern, email security@verdikx.com.
Compliance roadmap
- SOC 2 is on our compliance roadmap; security questionnaires are available on request.
- Our internal security program is documented in written policies: information security, access control, incident response, data retention, vendor management, business continuity and acceptable use. Policy summaries are available to customers on request.
- We hold no security certifications today, and we will not say otherwise until an independent auditor has issued one.
- For merchants subject to the GDPR, our Data Processing Addendum sets out our processor commitments, including the Standard Contractual Clauses for international transfers. It is listed with our other legal documents in the Trust Center.
Report a vulnerability
If you believe you have found a security issue in Verdikx, email security@verdikx.com with the affected URL or component, steps to reproduce and the impact you expect. Please do not post details publicly or contact merchants before the issue is fixed.
- We acknowledge reports within 3 business days and give an initial assessment within 10 business days.
- Test only against stores and accounts you own or have permission to use, don’t access other merchants’ data, and don’t run denial-of-service or volume testing. Research that follows these rules in good faith is welcome.
- Our contact details are also published in machine-readable form at /.well-known/security.txt.