Security

1. Our approach

ShipFeeder keeps a small amount of data, in few places, and protects it with well-understood controls. We hold no card numbers, and we collect only the shopper data a loyalty program needs. We are a new company and we do not claim security certifications we do not hold.

2. Infrastructure

ShipFeeder runs on Cloudflare Workers with the account and program database in Cloudflare D1. Pages and API requests are served over HTTPS. We do not run our own servers, which reduces the systems we have to patch and defend.

3. Encryption

• In transit: all traffic uses TLS. Plain HTTP requests are redirected to HTTPS.
• At rest: data in the database is encrypted at rest by our hosting provider.

4. Passwords and sessions

• Passwords are never stored. We store a salted PBKDF2 hash (SHA-256, 100,000 iterations) and compare it in constant time.
• Sessions use a random token. Only a hash of the token is stored on our side. The cookie is named shipfeeder_session, is HttpOnly, Secure and SameSite=Lax, and lasts 30 days.
• Sign-up and sign-in attempts are rate limited per address and email.
• State-changing requests must come from our own site, which blocks cross-site request forgery.

5. Store connections and webhooks

• Each store has its own keys. Order webhooks from Shopify and WooCommerce are checked with an HMAC signature, and orders with a bad signature are rejected.
• The same order cannot be counted twice, because orders are matched on their store and order reference.
• The public widget lookup returns only points, tier and referral code, and is rate limited. It never returns order details.
• You can replace a store's keys at any time if you think they were exposed.

6. Access and separation

• Every request to read or change program data checks that the store belongs to the signed-in account. One merchant cannot read another merchant's data.
• The back office is limited to named administrator accounts and is not linked from the site.
• Plan limits, such as orders per month, are enforced on the server.

7. Payments

Plans are paid on a hosted payment page run by Airwallex. Card details are entered there and never reach our website or servers. We keep only the plan, amount, date and payment reference. Airwallex describes its own security and compliance on its website.

8. Email

Shopper notifications are sent through Cloudflare Email Service. They contain a points balance and an unsubscribe link and never contain passwords or payment details.

9. Retention and deletion

You can delete your account from the account page. Program data is then removed within 30 days. Other retention periods are listed in the Privacy Policy. We do not use your data to train AI models.

10. Incident response

If we find or are told about a security incident affecting personal data, we investigate promptly, limit the impact, and notify affected merchants without undue delay. Where the law requires it we also notify the Information Commissioner's Office and the people affected.

11. Reporting a vulnerability

If you think you have found a security problem, email support@shipfeeder.com with the subject “Security”. Please include what you found and how to reproduce it. Please do not access other people's data, disrupt the service or publish details before we have had a reasonable time to fix the issue. We will acknowledge your report within 1 business day and keep you informed.

12. Providers we rely on

13. What you can do

• Use a long, unique password.
• Keep your store webhook secrets private and replace them if they leak.
• Sign out on shared computers.
• Tell us at support@shipfeeder.com if you see anything unusual in your account.