Security

Last updated: 14 October 2026

Quotes hold your customers' names, contact details and addresses. Here's how we protect them. To report a security issue, email shane@technocity.lk with the subject “Security”.

Hosting

  • The app server runs on Fly.io and the database on Neon (Amazon Web Services), both in Singapore.
  • All traffic uses HTTPS. The database is encrypted at rest and only accepts encrypted connections.
  • Every request from Shopify (app pages, storefront quotes, webhooks) is verified with Shopify's signatures before it is used.

Access

  • Only the people who build and run QuoteLoop can reach production systems, and only when needed to run or support the app.
  • Accounts for hosting, database, code and Shopify use two-factor authentication.
  • Passwords, API keys and access tokens are kept in our hosting provider's secret store and CI secrets, never in code.
  • The app asks Shopify only for the permissions it needs.

Protecting personal data

  • Only the popup fields a merchant turns on are saved.
  • Application logs never contain shoppers' personal details.
  • Merchants get an access log of every time staff open a quote, download a PDF or export a CSV.
  • Quote links and PDFs use long random addresses that can't be guessed.
  • Storefront requests are rate limited to prevent abuse.

Backups and retention

  • The database has point-in-time recovery, so data can be restored after an error.
  • Personal details in quotes are erased two years after a quote expires; sent emails after 90 days; access log entries after two years.
  • All of a store's data is deleted 48 hours after it uninstalls the app, and a customer's data when Shopify sends an erasure request.

If something goes wrong

If we suspect a security incident, we:

  1. Contain it: stop the cause, revoke or rotate affected keys and tokens, and block access where needed.
  2. Assess it: find out what happened, which stores and data are affected, and keep a record.
  3. Notify: tell affected merchants and Shopify without undue delay and within 72 hours, with what we know and what to do.
  4. Fix and learn: repair the cause, restore from backups if needed, and change our processes so it doesn't happen again.

More

See our privacy policy and data processing agreement.