Security and Incident Response

WarrantySure – Warranty & Product Registration · Last updated: October 21, 2026

This page describes how Appspedia Pvt Ltd protects the personal data that WarrantySure processes for merchants, and what we do if something goes wrong.

How data is protected

• Encryption in transit: all traffic to the App uses HTTPS (TLS). The App only talks to Shopify, Resend and its own server over HTTPS.
• Encryption at rest: the database, uploaded files and backups are stored on Oracle Cloud block volumes, which are encrypted at rest.
• Least data: we only store what customers enter in the form, the order number and product names. Order details and shipping addresses are read from Shopify only when needed.
• Private files: receipts and claim photos are never public; they open only through signed links that expire after 30 minutes.
• Access control: only the developer has access to the production server, using SSH keys (no passwords). The App runs as its own restricted system user.
• Access logging: every time personal data is viewed or exported in the App, and every order lookup from the storefront, is written to the server log with the store, time and action.
• Separate environments: development and testing use separate databases and development stores.
• Backups and data loss prevention: the database and files are backed up every day and backups are kept for 14 days.
• Deletion: Shopify privacy webhooks (customers/redact, shop/redact) delete the related registrations, claims and files.

Incident response

1. Detect and contain – on any sign of unauthorised access, data loss or a vulnerability, we immediately restrict access (rotate the Shopify app secret, email API key and SSH keys, block the affected endpoint or stop the App).
2. Assess – we review server and access logs to find what happened, which stores and what data were affected.
3. Notify – we inform affected merchants and Shopify without undue delay and within 72 hours of becoming aware of a breach involving personal data, with what happened, what data was involved and what we are doing.
4. Fix and recover – we fix the cause, restore from backups if needed and confirm the App is safe before reopening.
5. Review – we write down what happened and change our processes to prevent it happening again.

Report a security issue

Email support@appspedia.net with the subject "Security". We reply within 2 business days.