Security policy

Last updated October 1, 2026

This policy describes how Mint Labs protects the data Mint Shipping Rules handles, including personal data of merchants' customers processed on behalf of merchants. It applies to everyone at Mint Labs with access to our systems.

Data loss prevention

• We keep as little data as possible: the merchant's rules, rate tables, plan, setup status and the IDs of products carrying tags their rate tables use. The app stores no data about the merchant's customers — no names, email addresses, phone numbers, addresses, orders or carts.
• Delivery and payment rules run inside Shopify's checkout as Shopify Functions without network access, so cart and customer data from checkout never reaches our servers.
• Rate requests (rate tables only) contain the delivery address and the items. They are processed in memory to calculate rates and discarded; they are never written to our database, key-value storage or logs. We record only when the last request was answered, how long it took, how many rates were returned, its currency and whether Shopify's signature was valid.
• Our database is Cloudflare D1: encrypted at rest, with point-in-time recovery so it can be restored to any minute in the retention window.
• All traffic uses HTTPS (TLS). Production and development use separate databases; development never uses real merchant or customer data.
• Webhooks are verified with Shopify HMAC signatures; unsigned or tampered webhooks are rejected. The rate service address contains a random 128-bit secret per store, unknown stores get "not found", requests are rate-limited per store, and Shopify's request signature is checked and recorded.

Access control

• Only authorised Mint Labs personnel who need it to run and support the app can access production systems.
• The app has no internal screen that lets us browse merchants' data, and holds no customers' personal data to browse.
• Access is removed immediately when it is no longer needed.

Passwords and authentication

• Every account with access to production (hosting and Shopify Partner) uses a strong, unique password stored in a password manager.
• Two-factor authentication is required on all of those accounts.
• API secrets are stored as encrypted environment secrets, never in source code, and are rotated after any suspected exposure.

Logging

• Every request to the app is logged with a timestamp, path and status by our hosting provider's request logs. Our code never logs request bodies, so logs don't contain customers' names, email addresses or addresses.
• Logs are reviewed when investigating errors or suspected incidents.

Security incident response

1. Report. Anyone can report a suspected issue to support@stickermint.com. We acknowledge reports within one business day.
2. Contain. We stop the exposure first: disable the affected feature, revoke and rotate keys, access tokens and rate service secrets, and block abusive traffic.
3. Investigate. We use request logs and database history to find what happened, which shops and data were affected, and when.
4. Notify. If personal data was affected, we notify affected merchants without undue delay and within 72 hours of confirming the incident, and tell Shopify where required, with what happened and what we are doing about it.
5. Recover. We fix the root cause and, if needed, restore data from point-in-time recovery.
6. Review. We record each incident and the lessons learned, and update this policy.

Contact

Mint Labs — support@stickermint.com