Skip to content
AffCheck
Free check

Menu

Security

Version 1.1 · Last updated 19 September 2026

AffCheck is built and run by one person. We don't have a security team or a SOC 2 report, so this page explains plainly what we do to protect your data, and what we don't do.

Contents

  1. Where your data lives
  2. Encryption
  3. Access
  4. How we build and run the product
  5. Backups and deletion
  6. Product-specific measures
  7. What we don't have (yet)
  8. Reporting a vulnerability

1. Where your data lives

The application and database run on servers rented from Hetzner in Germany (EU), in ISO 27001-certified data centres. Cloudflare sits in front of the site for DNS, TLS and protection against attacks. Other services that receive data are listed on the Subprocessors page.

2. Encryption

  • All traffic uses HTTPS (TLS 1.2 or newer), with HSTS.
  • Disks and database backups are encrypted.
  • API keys, access tokens and other credentials for systems you connect are encrypted again inside the database (libsodium sealed boxes) with a key that is stored separately from the database. They are decrypted only in memory when a job needs them, never shown back in full, and never written to logs.

3. Access

  • Only the founder can access production systems, using SSH keys and two-factor authentication on every admin account (hosting, DNS, source code, email, payments).
  • Automated deployments use a separate key with limited rights.
  • We look at your data only when needed to support you, fix a problem you reported, or investigate abuse or a security issue.
  • Sign-in uses email and password or Google. Passwords are stored only as salted, slow hashes (never in plain text), and we never see them.

4. How we build and run the product

  • Every database query is scoped to your organisation, and automated tests check that one customer can't see another's data.
  • Dependencies are kept up to date and scanned for known vulnerabilities.
  • Staging and production are separate; staging never contains production personal data.
  • Errors and logs are kept on our own server for 30 days, and we scrub personal data (request bodies, tokens) from error reports.
  • Uptime is monitored every minute and alerts go to the founder.
  • We follow a written incident procedure. If a breach affects your personal data, we will notify you within 48 hours of becoming aware of it (see the DPA).

5. Backups and deletion

  • The database is backed up nightly and backups are kept for 60 days. We test restores regularly.
  • When you delete data or close your account, it is deleted from the live system within 30 days and from backups as they expire.

6. Product-specific measures

Store data

  • Read-only access. AffCheck requests only read_orders, read_discounts and, if you want older orders, read_all_orders. It can't change orders, refunds, discounts or anything else in your store.
  • No shopper contact details. We don't request shoppers' names, emails, phone numbers or addresses (Shopify protected customer data level 2).
  • Shopify access tokens and network API credentials are encrypted in our database and never logged.
  • Webhooks from Shopify are verified with their HMAC signature; invalid requests are rejected.
  • Order references are scrubbed from error reports.

Files

  • The free check never uploads your files: it reads them in your browser, in a Web Worker. The page's security policy only lets it connect to our own site and our cookieless analytics (which receive ranges such as "100–500", never order numbers, amounts or file names), and once the page has loaded the check works with no connection at all. Only two things are ever sent, and only when you ask: the column names of a file that didn't work (you see them before sending) and the totals of a result you ask us to email.
  • Your network export is read in your browser too. The app never receives the file: it reads the transaction rows on your device and sends only those. There is nothing for us to store, encrypt or lose.
  • Decline and amend files are built when you download them and are not kept on our side. The record of which decisions went into which file is.
  • Every export is recorded in an audit log you can see.

Your workspace is separate from everyone else's

  • Every screen, every action and every download is scoped to the workspace you are signed in to. A store, an import, a decline file or a transaction belonging to someone else is answered as "not found", never as "not allowed" — so nothing we say can confirm that another workspace's record exists.
  • That is not a promise we ask you to take on trust: an automated test signs in as one workspace, hands every single one of our server actions and download routes another workspace's identifiers, and fails the build unless each one answers "not found" and changes nothing. A test alongside it fails the build when a new action is added without a case.
  • Uploads are bounded. There is a limit on the size of a file the page will read, on how many files one drop opens, on the rows one import carries and on how many imports a store may start in a day. When one of those stops you, the message says which limit it was and what to do next.
  • Error reports we send to our own error tracker carry identifiers and nothing else — never a row from your file, never a file name, never a customer field. A test reads our code and fails on anything else.

Deleting data

  • Deleting a store deletes its data, immediately and for real: orders, refunds, transactions, flags, decisions, imports, export records and its activity log. Nothing is marked deleted and kept.
  • Deleting your account deletes the workspaces nobody else is a member of, and their stores with them.
  • Everything we keep has an end date, enforced by a job that runs every day: 13 months for orders, transactions and decisions, 24 months for your activity log. The full table is in our Privacy Policy.
  • Encrypted backups expire after 30 days, so deleted data leaves those within 30 days.
  • Uninstalling the Shopify app stops access immediately; all your store's data is deleted within 7 days of Shopify's deletion request, which it sends 48 hours after uninstall.

7. What we don't have (yet)

  • No SOC 2 or ISO 27001 certification of our own (our hosting provider is certified).
  • No 24/7 on-call team: alerts reach one person, so outside business hours in Central/Eastern Europe responses can be slower.
  • No bug bounty with payouts, but we are grateful for reports (see below) and will credit you if you like.

If your organisation needs a security questionnaire answered, email support@affcheck.com.

8. Reporting a vulnerability

Email security@affcheck.com with details and steps to reproduce. Please give us reasonable time to fix the issue before disclosing it, don't access or change other people's data, and don't run tests that degrade the service (no load or denial-of-service testing). We won't take legal action against good-faith research that follows these rules. We aim to acknowledge reports within 3 business days. A machine-readable contact is at /.well-known/security.txt.