Security is fundamental to how we build and operate our products. Merchants trust us with access to their store data, and we treat that trust seriously. This page documents the security measures we have in place across our infrastructure, application layer, and operational processes.
1. Infrastructure security
Our services are hosted on industry-leading cloud infrastructure with physical security controls, redundant power, and environmental protections. Key measures include:
- Cloud-native hosting: all services run in isolated, hardened cloud environments with network-level segmentation between production and non-production systems.
- DDoS protection: our infrastructure includes automated DDoS mitigation at the network edge.
- Vulnerability scanning: automated scanning of our infrastructure and application dependencies on a continuous basis.
- Patching policy: critical security patches are applied within 24 hours of release; non-critical patches within 14 days.
- Backups: data is backed up daily with point-in-time recovery capability. Backups are encrypted and stored in a geographically separate region.
2. Encryption
In transit
All data transmitted between your browser and our services is encrypted using TLS 1.2 or higher. We enforce HTTPS on all endpoints and reject plaintext connections. Our TLS configuration is reviewed regularly and scored against industry benchmarks.
At rest
All data stored by Snapper Apps — including sync logs, user account information, and API credentials — is encrypted at rest using AES-256. Database encryption keys are managed using a dedicated key management service and rotated on a regular schedule.
API credentials
Third-party API credentials (such as Afterpay API keys) are stored encrypted using envelope encryption and are never logged in plaintext. They are only decrypted in memory at the time of an API call.
3. Access controls
We apply the principle of least privilege across all systems:
- Role-based access control: team members only have access to the systems and data required for their role.
- Multi-factor authentication: required for all team members accessing production systems and internal tools.
- Privileged access reviews: access rights are reviewed quarterly and revoked promptly when no longer needed.
- Audit logging: all access to production systems and customer data is logged and retained for 90 days.
- Separation of duties: changes to production infrastructure require review and approval by a second team member.
4. Application security
Security is built into our development process:
- Code review: all code changes are peer-reviewed before deployment, with a security checklist for changes affecting data access or authentication.
- Dependency management: we use automated tools to detect and alert on vulnerable dependencies in our application code.
- Input validation: all user inputs are validated and sanitised server-side. We protect against common vulnerabilities including SQL injection, XSS, and CSRF.
- Penetration testing: we conduct penetration tests on our core applications at least annually and remediate critical findings within 30 days.
- Minimum permissions: our Shopify app integrations request only the minimum API scopes required to perform their function.
5. Incident response
We maintain a documented incident response plan. In the event of a security incident:
- We aim to contain and investigate all potential security incidents within 24 hours of detection.
- Affected customers will be notified within 72 hours if their data is involved in a breach, as required by applicable data protection regulations.
- We will provide a clear description of what happened, what data was affected, what steps we have taken, and what you should do.
- Post-incident reviews are conducted to identify root causes and prevent recurrence.
To report a potential security vulnerability, please email appsupport@snapperapps.com. We will acknowledge all reports within 48 hours.
6. Vendor security
We carefully evaluate the security practices of our sub-processors and service providers. All vendors with access to personal data must agree to our data processing requirements and demonstrate appropriate security controls. Our sub-processor list is available on request.
7. Compliance
Our security programme is designed to meet the requirements of:
- Shopify Partner Programme — compliance with Shopify's security requirements for app developers
- Privacy Act 1988 (Australia) — Australian Privacy Principles for the handling of personal information
- GDPR — where applicable for customers in the European Economic Area
We are working toward formal SOC 2 Type II certification. If you have specific compliance requirements, contact our team to discuss.
8. Contact security
For security concerns, vulnerability reports, or compliance questions:
- Security email: appsupport@snapperapps.com
- General contact: snapperapps.io/contact