Reporting a security issue
Email security@preproduct.io. We aim to reply within 2 business days.
Data we store
- Customer names and email addresses, so we can manage pre-orders and send updates.
- For BigCommerce stores, shipping addresses as well.
- We never store card details. Payments are handled by Shopify or Stripe.
How your data is protected
- All traffic uses HTTPS. HTTP requests are redirected, HSTS is enforced, and cookies are marked secure.
- App traffic passes through Cloudflare’s proxy.
- Database and Redis storage is encrypted at rest by Render.
- Every database and data store (Postgres, Redis, Valkey) is password protected.
- Secrets and environment variables are never committed to version control.
Who has access
- Only the two founders have production access, protected by two-factor authentication.
- Two-factor authentication is required on every service of consequence.
- Shopify’s IP allowlist is set to enforce mode, so only our servers can make requests to Shopify with our API tokens.
- Shopify API tokens expire after one hour.
How we build
- Members of Daybreak Blue, OpenAI’s blue team security program.
- Automated security audits of our codebase run on a schedule, using the top available OpenAI and Anthropic models. They don’t depend on anyone remembering to run them.
- Extra audits whenever news affects our tech stack or the Shopify ecosystem.
- Every deploy runs Shopify’s app security check alongside our test suite.
- Dependencies are monitored and patched promptly, with a short delay on non-critical updates to guard against supply chain attacks.
Infrastructure
- Hosted on Render. Render is SOC 2 compliant, runs penetration testing and has a dedicated security team.
Monitoring and incident response
- Application logs and usage monitoring are centralised in Datadog, so we can spot and investigate suspicious activity quickly.
- If we confirm a breach affecting your data, we’ll notify you within 72 hours.
Keeping our footprint small
We weigh security in bigger business decisions too. We recently ended WooCommerce support because the extra exposure wasn’t worth it for a small part of our business.
Subprocessors
| Subprocessor | Purpose | Location |
|---|---|---|
| Render | App hosting, database, background jobs | US |
| Amazon Web Services (S3) | Merchant-uploaded images | US |
| Cloudflare | DNS, proxy, webhook processing, AI upsell suggestions | Global |
| Mailgun | Emails to merchants and customers | EU |
| Stripe | Customer payments (only if you connect Stripe) | Global |
| Paddle | Merchant subscription billing | Global |
| Datadog | Logging and monitoring | EU |
| PostHog | Product analytics | EU |
| Email Octopus | Marketing emails to merchants (no customer data) | |
| Tiny Funnel | Onboarding analytics (operated by us) | |
| Context Link | Answers in the Shopify Sidekick extension (operated by us) | |
| Google reCAPTCHA | Bot protection on sign-up and login | Global |
| ipregistry | IP-to-location lookup |
What’s next
- We’ll keep up to date with Shopify and industry security advisories.
- We’re adding a red team process to test our defences from an attacker’s side, alongside our existing audits.