Security is central to how Syncwright is built. The app handles Protected Customer Data at Shopify's Level 2, so we treat customer personal information with care and store as little of it as possible. This page summarizes the measures we have in place.
Principles
Two ideas drive our design. First, keep customer personal data in flight, not at rest: the less we store, the less there is to protect. Second, least privilege everywhere: we read only the fields we need, grant access only to those who need it, and log what happens.
Encryption
- In transit: all connections between Syncwright, Shopify, and Lightspeed use TLS.
- At rest: our database (Cloudflare D1) is encrypted at rest.
Credential handling
Per-merchant connection credentials (OAuth tokens for Shopify and Lightspeed) are stored as Cloudflare Worker secrets or as encrypted values in D1. They are never written to logs. When a store uninstalls, its credentials are destroyed as part of the deletion flow described below.
Data minimization
Syncwright reads only the customer fields it needs (name, email, phone, and shipping and billing address) and only for customer matching, creating a Lightspeed sale, and merchant-facing error logs. Any other fields returned by the APIs are discarded. Customer personal data is not stored at rest: it passes through the Cloudflare Workers engine to the Lightspeed API in flight only. Our database holds sync metadata (record identifiers, timestamps, error codes) and credentials, not customer PII.
Access control and logging
- Multi-factor authentication is required for production Cloudflare access.
- Access logs are captured through Cloudflare Workers Observability.
- Production access is limited to the people who operate the service.
Incident response
We maintain a written incident-response policy. In the event of a security incident it covers breach containment, merchant notification consistent with applicable law, rotation of any affected secrets, and a post-incident review to prevent recurrence. Where a personal data breach affects a merchant's data, we notify the affected merchant without undue delay so they can meet their own obligations.
Deletion and crypto-shredding
Syncwright honors Shopify's compliance webhooks, each verified with an HMAC signature and completed
within 30 days. A customers/redact request deletes the tenant-scoped sync metadata for
that customer. A shop/redact request, sent after a store uninstalls, deletes all of the
store's data and crypto-shreds its stored credentials, so the connection cannot be
reused.
Report a vulnerability
If you believe you have found a security vulnerability in Syncwright, please tell us so we can fix it. Email help@syncwright.io with details and steps to reproduce. We appreciate responsible disclosure and will acknowledge your report and keep you updated as we investigate.