Security

This page describes how the Marka Shopify apps protect your store's data. It is also Annex II of our Data Processing Addendum.

1. Hosting

All four apps run on Microsoft Azure in the United States: Central US for Marka Reviews and Marka Bundles & Upsells, North Central US for Marka Cart Drawer and Marka Metrics. Microsoft is responsible for the physical security of its data centres. Database connections require credentials and are encrypted, and the databases are not open to the internet without network rules.

2. Encryption

• In transit. Every connection to an app, and from an app to its database, is encrypted with TLS. The apps serve only HTTPS.
• At rest. Databases, files and backups are encrypted by Azure.
• Inside the apps:
  • Store access tokens are encrypted with AES-256-GCM in Marka Reviews, Marka Bundles & Upsells and Marka Metrics.
  • Customer contact details are encrypted with AES-256-GCM in Marka Cart Drawer and Marka Metrics. Marka Cart Drawer uses a key for each store.
  • Customer IDs are kept only as keyed hashes in Marka Bundles & Upsells.
  • Shopify's browser IDs are pseudonymised in Marka Metrics.
• Secrets (database passwords, encryption keys, Shopify credentials) are kept out of our source code, in Azure Key Vault or the hosting platform's encrypted settings.

3. Requests the apps accept

• Every message from Shopify is checked against Shopify's signature before it is acted on: webhooks, app proxy requests and admin sessions. Unsigned or tampered requests are refused.
• Storefront endpoints limit how often they can be called, so one visitor or store cannot overload them.

4. Keeping stores apart

Every record belongs to one store, and every query is scoped to that store. One store's data is never shown to another, or combined with another's.

5. Access by our staff

Access to production systems is limited to the people who build and run the apps. Beyond that:

• Marka Bundles & Upsells. Our staff can see a store's data in the app only when the store's owner grants it, for 24 hours, for a stated reason. Every access is recorded in a log the owner can see.
• Marka Cart Drawer. Before a customer contact detail is decrypted, the purpose and the fields are recorded in an access log.
• Marka Metrics. Views, searches and exports of customer details are recorded in an audit log.

6. Logs and backups

• Technical logs are kept for 30 days. Marka Metrics strips query strings and download tokens from its access logs before they are written.
• Databases are backed up by Azure and kept for 7 days (Marka Reviews, Marka Cart Drawer) or 14 days (Marka Bundles & Upsells, Marka Metrics). Backups stay in the same region.

7. If something goes wrong

If we confirm a breach of security that affects your store's data, we will tell you without undue delay, and within 48 hours of confirming it. We will say what happened, what data is affected, what we have done and what you may need to do, and we will help you meet any duty you have to notify others.

8. Reporting a vulnerability

Email support@houseofmarka.com with the subject SECURITY. We acknowledge within one business day and keep you informed. Please give us reasonable time to fix the issue before you publish it. We will not take action against good-faith research that does not access other merchants' data, degrade the service or keep data.

9. Certifications

We do not currently hold SOC 2 or ISO 27001 certification. Microsoft Azure, our hosting provider, holds both.