Security & Data Protection

Last updated: 1 August 2026

This page is PayMatch's written security policy: what we collect, how it's protected, how long we keep it, and what we do if something goes wrong.

Data we collect and why

• Shop domain and access token — issued by Shopify at install, used to read your open orders and mark orders paid on your behalf.
• Uploaded bank statement rows — date, description, amount, reference, and sender name, used only to match payments to orders. This data comes from your own bank export, never from Shopify's Customer API.
• Matched order references — the Shopify order ID/name a transaction is confirmed against.

PayMatch never requests the read_customers scope and never queries the Customer object directly — customer names used for matching come only from the order object itself, the same data already visible on that order in your Shopify admin.

Encryption

All traffic to and from PayMatch is served over HTTPS/TLS (enforced by Cloudflare Pages). Data at rest lives in Cloudflare D1, which encrypts data at rest on Cloudflare's underlying storage infrastructure. Shopify access tokens are stored per-shop and are never exposed to the browser or to any third party.

Access control

Only the merchant's own authenticated embedded-app session (verified via a Shopify session token on every request) can read that shop's data. There is no shared or cross-shop access, no admin UI that lists other merchants' data, and no third party is given access to the database. Internal access to production infrastructure (Cloudflare account, D1) is limited to the app's single operator and gated by account-level 2FA.

Data retention and deletion

Bank-transaction and statement records are automatically deleted 90 days after they were created, whether or not the merchant acted on them, via a lazy cleanup pass that runs on every webhook and app-load request. Audit-log entries follow the same 90-day window. Uninstalling the app deletes all data for that shop immediately — shop record, statements, transactions, and access log — via Shopify's app/uninstalled and shop/redact webhooks. A customers/redact request deletes transaction records matched to that customer's orders (identified via the order-ID list Shopify includes in the webhook payload) immediately. A customers/data_request is logged and the held records are forwarded to our support address so the merchant can fulfil the request.

Data loss prevention

• Least privilege — the OAuth scope set is limited to read_orders and write_orders; we never request read_customers or any scope we don't use.
• Minimal extraction — only the fields needed to match and confirm a payment (date, amount, description, reference, sender name, matched order) are stored, and only for the 90-day window above.
• No third-party sharing or resale — data is never sold, shared for advertising, or handed to any party outside the processing pipeline required to run the app (Cloudflare for hosting/storage).
• Idempotent, indexed deletes — retention and redaction both run as simple indexed DELETE statements, so cleanup can safely run repeatedly without side effects or partial state.

Incident response

If a security incident is suspected:

1. Detect — via Cloudflare's request/error logging and alerting on the Pages project and D1 database (unusual access patterns, spikes in failed auth, unexpected data volume).
2. Contain — immediately rotate the affected API keys/secrets (Shopify app secret, Resend key) and revoke any compromised access tokens.
3. Assess — determine which shops and data fields were affected using the access log and Cloudflare request logs.
4. Notify — affected merchants are notified via the support contact on file within 72 hours of confirming a breach, describing what happened and what data was involved.
5. Remediate — patch the root cause, deploy the fix, and run a post-mortem to prevent recurrence.

Contact

Report a security concern or data request via the support form.

← Back to PayMatch