Effective date: August 3, 2026
Owner: Peter Nuako / Amamrefie
Review frequency: Quarterly and after material security changes or incidents
1. Objective
This strategy reduces the risk that merchant or customer information is lost, disclosed, altered, copied, or retained beyond its intended purpose. It applies to Amamrefie Customer Portal & Loyalty source code, Shopify integrations, Google Cloud services, development devices, support processes, and authorized operators.
2. Data Minimization
- The customer portal retrieves customer and order information directly from Shopify when an authenticated customer uses the portal.
- Customer profiles, addresses, and order histories are not permanently copied into the Amamrefie database.
- Customer-linked operational events, if introduced, are limited to necessary fields and automatically deleted after 30 days or upon a valid redaction request.
- Payment-card numbers and customer passwords are never collected by the App.
- Production data must not be copied into staging, development, source repositories, support tickets, or local test files.
3. Environment Separation
- Production and staging use separate Shopify apps, Cloud Run services, PostgreSQL databases, database users, connection secrets, and Shopify client secrets.
- Development stores use only the staging app. Merchant production stores use only the production app.
- Staging may share the managed Cloud SQL server to control cost, but its logical database credentials cannot access the production database.
- Test fixtures must be synthetic or belong to authorized development-store test accounts.
4. Access Control
- Access follows least privilege and is limited to the minimum number of authorized operators.
- Cloud Run receives secrets from Google Secret Manager; secrets are not committed to source control or placed in support messages.
- Database users are environment-specific. Interactive database access is granted only when required for an approved operational task.
- Google Cloud and Shopify accounts must use multi-factor authentication where available.
- Access and IAM bindings are reviewed quarterly and promptly after a role or personnel change.
5. Encryption and Secret Handling
- Data is encrypted in transit using HTTPS/TLS and encrypted at rest by Shopify and Google Cloud managed services.
- Client secrets, database URLs, access tokens, and generated passwords are classified as confidential credentials.
- Exposed or suspected credentials are rotated immediately, replaced in Secret Manager, and disabled or destroyed in prior secret versions.
- Production secrets must never be reused in staging.
6. Logging and Detection
- Application logs must not contain access tokens, passwords, client secrets, full customer payloads, or unnecessary personal data.
- Successful portal reads and profile updates are recorded in a dedicated audit trail with the authenticated customer identifier, store, timestamp, action, data categories, source, and outcome.
- Audit records contain no names, email addresses, phone numbers, postal addresses, order contents, access tokens, or customer payloads.
- Customer-data audit records are automatically deleted after 30 days and are removed earlier when Shopify sends a valid customer-redaction request.
- Cloud Run, authentication failures, webhook failures, deployment changes, IAM changes, and Secret Manager access are reviewed when investigating anomalies.
- Unexpected increases in authorization failures, data requests, outbound traffic, or database access trigger investigation.
- Only store domains, non-sensitive resource identifiers, event types, timestamps, and sanitized error messages may be logged when operationally necessary.
7. Prevention Controls
- Shopify authenticates customer sessions and signs mandatory privacy webhooks.
- The App rejects invalid webhook authentication through Shopify's verified webhook handler.
- Customer data is processed only for documented account functionality and customer service purposes.
- Automated retention removes expired customer-linked events.
- Source archives exclude `.env` files, Git history, dependency folders, build outputs, and existing archives.
- Production deployments require an intentional production configuration; staging uses a separate configuration and runtime marker.
8. Incident Response
When suspected data loss or unauthorized disclosure is identified:
1. Stop the affected deployment or revoke access when needed to contain the event.
2. Rotate affected Shopify, database, Google Cloud, and automation credentials.
3. Preserve relevant sanitized logs and record the incident timeline without copying unnecessary personal data.
4. Determine affected stores, data categories, individuals, systems, and time period.
5. Remove unauthorized copies, correct access controls, and validate the fix.
6. Notify affected merchants without undue delay after confirming a breach and provide information needed for legally required notifications.
7. Document the cause, response, and preventive actions, then review this strategy.
9. Recovery and Availability
- Cloud SQL uses managed encrypted storage and configured backups.
- Restore testing must use an isolated environment and must never overwrite production.
- A restore test and deletion verification are performed at least annually and after major database changes.
- Application source and infrastructure configuration are maintained so a service can be rebuilt without copying customer data into source control.
10. Customer Rights and Deletion
- Mandatory Shopify privacy webhooks support customer data requests, customer redaction, and shop redaction.
- Verified customer redaction deletes customer-linked operational records.
- Shop redaction deletes account settings, events, sessions, and shop records associated with that merchant.
- Required privacy actions are completed within 30 days unless retention is legally required.
11. Reviews and Evidence
Quarterly reviews confirm:
- Production and staging remain separated.
- IAM and Secret Manager access remain least privilege.
- No secrets or personal-data exports exist in source control.
- Retention and redaction handlers remain active.
- Required credentials have not been exposed and outstanding rotations are complete.
- Backup and restore settings are appropriate for the current service.
Evidence may include dated access-review results, deployment records, webhook tests, credential-rotation records, restore-test records, and incident reports. Evidence must not include secret values or unnecessary personal data.