Security
An identity-verification app is only as trustworthy as its handling of sensitive data. This is what we do, in plain terms.
Collect less
- We do not store ID images on our own servers, and we do not store document numbers or dates of birth. The verification partner holds the photos only for the retention period the merchant chooses (default 30 days, maximum 90) and then deletes them for good.
- We request the minimum Shopify permissions the features need, and each one is explained in the app listing.
Protect what we do hold
- All traffic is encrypted with TLS.
- Merchant admin access is authenticated with Shopify's signed session tokens. No passwords for merchants are stored.
- Every merchant can reach only its own records. Cross-store access is blocked and covered by automated tests.
- Webhooks from Shopify and from our verification partner are signature-checked, replay-protected and processed once.
- Customer verification links are long, random and expire; verification pages cannot be embedded in other sites.
- Access tokens and secrets are kept server-side, never in the browser or in code.
- Access to verification results is logged, and so is every time someone views an ID photo.
- ID photos are fetched on demand through our server, sent with no-cache headers, and never written to our disks.
Be ready
- Customer data requests and erasure requests from Shopify are honoured automatically, and a shop's data is erased after uninstall.
- We back up our own credentials and configuration, and we test our releases before they ship.
Incident response
We keep a written incident response policy. In summary:
- Detect and triage. Reports from merchants, customers, researchers, Shopify or our own logs are triaged the same day we see them; anything involving personal data is treated as urgent.
- Contain. We cut off the cause first: revoke or rotate affected credentials and tokens, disable the affected feature or route, and preserve logs for investigation.
- Assess. We establish what happened, which merchants and customers are affected, and what data was involved.
- Notify. We tell affected merchants without undue delay and within 72 hours of confirming a breach, so they can meet their own obligations. We notify Shopify and the relevant authorities where the law requires it.
- Recover and learn. We fix the root cause, restore service, and write a short review of what changed so it does not recur.
Report a vulnerability
If you believe you have found a security issue, please email security@realidchecker.com with the details. Please give us a reasonable chance to fix it before you disclose it publicly, and do not access other people's data. We will acknowledge your report within three business days.