Customer Data Health — Security

1. Scope

This policy describes the current security boundary for Customer Data Health. It is an engineering description, not a penetration test, certification or legal opinion.

2. Shopify access

The documented workflow uses these Shopify permissions:

• read_customers and write_customers for customer quality review and approved corrections.
• read_customer_merge and write_customer_merge for duplicate review and an explicitly approved merge.

The app does not request theme, checkout or marketing permissions. Shopify controls access to protected customer data and may require additional review before production use.

3. Authentication and tenant isolation

Shopify OAuth and authenticated Admin requests establish the store context. Server-side loaders, actions, jobs and reports scope records to the authenticated store; a browser parameter is never an authorisation boundary. Sessions, tokens and application secrets stay on the server.

4. Webhooks and write safety

Shopify webhook authenticity is verified before processing. Customer deletion/redaction, shop redaction and uninstall events revoke access or remove the relevant store-scoped data. Corrections and merges require explicit confirmation, use bounded background work and surface failures instead of silently presenting a partial result as complete.

5. Data minimisation and logs

The stored fingerprint mirrors only the fields needed by the enabled detectors. Customer fields are not placed in ordinary application logs or sent to advertising systems. HTTPS, security headers, rate limits and database tenant scoping protect the public and authenticated routes. No SOC 2, ISO 27001 or similar certification is claimed.

6. Vulnerability disclosure

Report a suspected security issue through the support form or email support@narrowforge.com. Include a concise description and reproduction steps. Do not include credentials, tokens or unnecessary customer data, and do not disclose the issue publicly before it has been reviewed.

Last updated: 2026-09-12.