Security and Incident Response

Last updated: 13 September 2026

Quiet Tools is a one-person operation. This document says plainly what that means for security: what is in place, what a merchant can expect if something goes wrong, and how fast.

What protects merchant data

• Minimal collection. Our apps do not request customer names, email addresses or phone numbers. Shipping addresses are stored as a SHA-256 hash, never as text. This is the primary control: data not collected cannot leak.
• Transport. All traffic is served over TLS with certificates renewed automatically.
• Isolation. The database accepts connections only from the application on the same host and is not published to the internet. The server runs no unrelated services.
• Access. Server access is by SSH key only, with password authentication disabled and a firewall limiting open ports to SSH, HTTP and HTTPS.
• Backups. Database backups are encrypted before leaving the server. The encryption key is stored separately from the backups. Restores are tested, not assumed.
• Retention. Technical logs, error text and access logs are deleted automatically after 30 days.
• Audit trail. Every read or change of store data is recorded with time, actor and action.

What counts as an incident

• Unauthorised access to the server, the database or a backup.
• Exposure of credentials: Shopify API secrets, access tokens, backup keys.
• A defect that caused store data to be disclosed to the wrong party.
• Loss of data that cannot be restored from backup.

Ordinary faults — a failed combine, an unavailable API, a bug that shows the wrong number on screen — are not incidents under this policy. They are handled through support.

What happens when one occurs

1. Contain. Revoke the affected credentials, take the service offline if continuing would widen the exposure.
2. Assess. Determine which stores are affected, which data categories are involved, and over what period.
3. Notify. Affected merchants are notified by email within 72 hours of the incident being confirmed, with what happened, what data was involved, and what they should do. Shopify is notified in parallel where the incident concerns the platform or its APIs.
4. Fix and record. Close the cause, verify the fix, and write up the incident and the change made to prevent recurrence.

Merchants are notified even where the law would not require it — for example where exposed data contained no personal data. A merchant deciding whether to trust an app deserves the facts either way.

Reporting a vulnerability

Write to support@quiettools.net with enough detail to reproduce the issue. Reports are acknowledged within two working days. There is no bounty programme; there is a genuine thank-you and a fix.

Please do not test against other merchants' stores, and do not access data that is not yours.

The honest limitations