Narrowforge Intrastat Europe — Security

1. Scope

This policy describes the security boundary for Narrowforge Intrastat Europe, an embedded Shopify app that prepares dispatch data for merchant review. It is a description of the controls and limits in the current release, not a certification.

2. Shopify permissions

The production app requests these read scopes for its documented job:

• read_orders — read order, line-item, destination and refund data.
• read_products — read product and variant identifiers and weight metadata.
• read_locations — read fulfilment locations for merchant-confirmed mapping.
• read_fulfillments — read shipped quantities, dates and fulfilment locations.

The app does not request write permissions for orders, products, customers, themes or checkout. Customer names, email addresses, phone numbers and street-address lines are not requested by the sync query.

3. Authentication and tenant isolation

Shopify authentication establishes the store context. Server-side loaders and actions derive the tenant from the authenticated session, and database records are scoped by the store identifier. Browser-supplied identifiers are not an authorisation boundary. Session tokens and application secrets stay on the server.

4. Webhooks, jobs and export integrity

Shopify webhook signatures are verified before processing. Delivery identifiers make webhook receipts and background jobs idempotent, and stale work is reclaimed explicitly. Incomplete Shopify connections create a blocking issue rather than a partial movement. Finalized declarations and export artifacts carry SHA-256 hashes; the download route re-checks those hashes and the store context before returning a file.

5. Data minimisation and failure handling

The app stores reporting data, merchant-entered configuration, issue and audit metadata needed for the workflow. It does not store a customer profile or use an advertising data pipeline. Shopify API failures, rate limits, missing permissions and unresolved fields are surfaced as unavailable, blocked or review states; they are not converted into a clean export by assumption.

6. Vulnerability disclosure

Report a suspected security issue privately through the support form with category Security, or email support@narrowforge.com. Include a concise description, reproduction steps and the affected feature. Do not include credentials, tokens or unnecessary personal data, and do not publicly disclose the issue before review.

7. Certifications and contact

Narrowforge Intrastat Europe does not currently claim SOC 2, ISO 27001 or another formal security certification. If that changes, the scope and effective date will be stated here. For security questions, contact support@narrowforge.com.

Related: Privacy policy · Terms of service · Customer support

Last updated: 2026-09-09.