Information Security Policy

1. Scope and purpose

This policy describes how ShopSheets ("we", "us") protects customer data when operating our read-only reporting service. It applies to all systems, code, and personnel that handle data originating from our customers' connected platforms (Klaviyo, Meta, Google Ads, TikTok, AppLovin, Shopify, Xero) and to credentials our customers authorize us to hold.

2. Data classification

• Credentials — OAuth refresh tokens, access tokens, and platform API keys. Treated as the most sensitive data class.
• Consumer data — end-customer profile fields (email, phone, name, address, location, consent state) sourced from connected platforms.
• Financial / transaction data — order, revenue, attribution, and conversion events sourced from connected platforms.
• Operational metadata — connection names, query schedules, run logs.

3. Encryption

• In transit: TLS 1.2+ enforced on every customer-facing endpoint. We do not accept plaintext HTTP. All third-party API calls (Klaviyo, Meta, Google, etc.) use HTTPS.
• At rest: Credentials and integration metadata are stored in Base44, which encrypts at rest with AES-256. Transient query results are stored in Supabase Postgres, which encrypts at rest. Application secrets (OAuth client secrets, service-role keys) live only in Railway environment variables — never in code or logs.

4. Access control

• Customer data is partitioned by workspace and connection. Application code only resolves an integration row by entity id or account identifier; cross-tenant queries are rejected.
• Production credentials and infrastructure are accessible only to authorized engineering personnel. All admin access requires multi-factor authentication.
• ShopSheets requests read-only OAuth scopes from every connected platform. We cannot create, modify, or delete records in our customers' platforms.

5. Data retention and deletion

• Query result rows are written to a transient Supabase table during a fetch. Rows are surfaced to the customer's Google Sheet and deleted within 24 hours.
• OAuth tokens and integration metadata persist until the customer disconnects the integration or deletes the workspace, at which point the corresponding records are removed.
• Run logs (timestamps, status, row counts) are retained for 90 days for operational troubleshooting and then purged.
• Customers can request export or deletion of any data we hold by emailing periel@wearegrowth.co.

6. Third-party data sharing

We do not sell, license, or share customer data with third parties. Data flows are limited to: (1) the connected platform's API → ShopSheets backend, (2) ShopSheets backend → the customer's own Google Sheet. We use a small set of well-known SaaS sub-processors solely to operate the service: Base44 (auth + entity storage), Supabase (transient query results), Railway (compute), Google (OAuth identity, Sheets API). All sub-processors are contractually prohibited from using customer data for any purpose other than serving ShopSheets.

7. Vulnerability management

• Application dependencies are monitored via automated security advisories. Critical vulnerabilities in production dependencies are patched within 7 days of disclosure; high within 30 days.
• The codebase is tracked in private Git repositories with branch-protection rules requiring review before merge. Production deploys are gated on a green build (TypeScript, lint, tests).
• Penetration testing and security review are performed before any major release that changes the data flow or authentication model.

8. Incident response

In the event of a confirmed security incident affecting customer data, ShopSheets will:

• Contain the incident immediately by revoking implicated credentials and isolating affected infrastructure.
• Notify affected customers in writing within 72 hours of confirmation, including the nature of the incident, data categories impacted, and remediation steps.
• Coordinate with the connected platform (Klaviyo, etc.) where appropriate to support their own incident response and customer notifications.
• Conduct a post-incident review and publish remediation steps.

9. Personnel

All personnel with access to customer data are bound by confidentiality terms in their employment or contractor agreements. Access is granted on a least-privilege basis and revoked promptly upon role change or departure.

10. Customer responsibilities

• Customers should authorize the least-privilege Klaviyo (or other platform) account appropriate for the data they want to report on.
• Customers should disconnect integrations they no longer use; tokens are not auto-expired until 60 days of inactivity (Klaviyo) or per platform.
• Suspected unauthorized access should be reported to periel@wearegrowth.co within 24 hours of discovery.

11. Contact