Trust
SutraApps Security
Security is part of how we build. This page explains, in plain language, the approach we take to protecting the data our Shopify apps handle for merchants and their customers.
Last updated: 4 September 2026
We describe our approach at a level that is useful without exposing internal configuration. We do not claim any certification we do not hold.
1. Data Protection
We only collect the data an app needs to work, and we keep it separated by store. Merchant data is never mixed between stores, and we do not use customer data for our own purposes.
2. Encryption
Data is encrypted in transit using industry-standard TLS, and stored data is protected by encryption at rest provided by our infrastructure providers.
3. Access Controls
Access to production systems is limited and authenticated. In practice this means:
- Access is granted only where it is needed to operate or support an app
- Strong authentication is required for administrative access
- Credentials are stored in a secrets manager, never in source code
- Access is reviewed and removed when it is no longer needed
4. Data Retention
We keep data only as long as it is needed to provide the app. When an app is uninstalled, associated store data is deleted or anonymized in line with Shopify's requirements and applicable law.
5. Backup Protection
Backups are handled by our infrastructure providers, are encrypted, and are subject to the same access restrictions as production data. Backups are retained for a limited period and then removed.
6. Environment Separation
Development, testing and production environments are kept separate. We avoid using real merchant or customer data outside production.
7. Monitoring and Logging
We log application and system events to detect errors and unusual activity. Logs are designed to avoid unnecessary personal data and are retained for a limited period.
8. Incident Response
If we detect or are notified of a security issue, we investigate promptly, work to contain and resolve it, and notify affected merchants without undue delay with the information available to us. Suspected vulnerabilities can be reported to sutraapps.team@gmail.com and we will acknowledge responsible reports.
Questions about this document? Email sutraapps.team@gmail.com.