Security and data protection

How FirstFrame Bot Blocker protects the data it handles, and what we do if something goes wrong. Last updated 4 November 2026.

Only what is needed

The app asks Shopify for no access permissions. Visitor IP addresses are used in memory for the network lookup and never stored. What the app keeps is listed on the privacy page.

Encryption

In transit: every connection (the storefront check, the app inside Shopify admin, Shopify's API and webhooks, email) uses TLS.
At rest: data lives on Railway, which encrypts stored data, including volumes and their backups, with AES-256.

Access

A store's staff see only their own store, through Shopify's signed session tokens, checked on every request.
Shopify access tokens expire and are refreshed automatically. They are never shown in the app, written to logs or kept in source code.
Webhooks from Shopify are accepted only with a valid signature.
The storefront check is rate-limited per visitor and counts each visitor once per 30 minutes, so counts cannot be flooded.
Operator access is limited to the owner, through a secret admin key, and is used only for setup and support. Operator accounts (hosting, Shopify Partners, email) use unique strong passwords and two-step verification.
Requests that read a store's data are logged (who, which store, what, when; never the data itself). The log is kept for 14 months.

Keeping, backing up and deleting

Daily counts are kept for 90 days and then deleted automatically.
The data volume is backed up by Railway (encrypted). Backups expire on Railway's schedule.
Uninstalling deletes the store's access tokens at once. Shopify's shop erase request deletes everything kept for the store.

If something goes wrong

Contain: rotate the affected secrets (app secret, admin key, hosting token) and revoke store access tokens if needed.
Assess: use the access log and hosting logs to find what was reached, which stores, and when.
Notify: tell every affected store and Shopify within 72 hours, with what happened and what they should do.
Fix and review: close the cause, restore from backup if data was lost, and write down what changed.

Report a security problem to adam@inlinex.com.sg.