Security

Workflow Trigger Extensions is built and operated by Code Creation Labs. This page explains what the app is made of, where it runs, how your store's data is protected and how we keep everything up to date. It is written for store owners and for anyone filling in a security questionnaire. The legal side (privacy policy, data processing agreement, sub-processors) is on Legal & data protection.

What the app is built on

Layer	What we use
Application code	TypeScript on Node.js, a current long-term-support release. Every part of the app, from the admin pages to the workers that process your events, is one code base.
Database and cache	PostgreSQL (Google Cloud SQL) and Redis (Google Cloud Memorystore)
Hosting	Containers on Google Kubernetes Engine in Google Cloud region europe-west1 (Belgium, European Union). Databases, caches and file storage are region-local.
Shopify integration	Shopify's official app libraries, the Admin GraphQL API and webhooks delivered through Google Cloud Pub/Sub
Your storefront	Nothing runs in your theme. The optional web pixel behind the Storefront triggers runs inside Shopify's pixel sandbox and is installed only when you switch a storefront trigger on.

There is no PHP, WordPress, Java or other runtime anywhere in the service. The app is listed on the Shopify App Store and passed Shopify's app review, which covers Shopify's security and protected customer data requirements.

How your data is protected

In transit. Every connection between your browser, Shopify and the app uses TLS. The database and the cache have no public address: they are reachable only from inside our private network.

At rest. All databases and storage are encrypted at rest with keys we manage in Google Cloud KMS.

Field-level encryption on top. The most sensitive values get a second layer: your store's Shopify access token, and the protected customer data (names, email addresses, phone numbers, postal addresses) read by the opt-in personal-data triggers. Each record is encrypted individually with AES-256-GCM under a separate key in Cloud KMS, with automatic key rotation. The values are decrypted in memory only at the moment they are needed, for example when a trigger fires, and they are never written to logs. Change detection on personal data compares hashes, so the app can tell that a value changed without decrypting it.

Secrets. API credentials and keys live in Google Secret Manager and are loaded when a service starts. They are not in the code, not in the container images and not in the build pipeline.

Data minimisation. The app asks for no data access on install. Every permission is opt-in, scoped to one kind of data, and can be revoked at any time. See Permissions and data access.

Who can access what

• Your store only. Every record carries the store it belongs to, and every query is scoped to the store that was authenticated. One store can never read or change another store's data.
• Verified requests only. Pages inside the Shopify admin are authenticated with Shopify session tokens. Webhooks and Flow callbacks are verified by Shopify's HMAC signature, and internal messages by Google-signed identities, before any data is touched. Every Shopify event is processed once, deduplicated by its event id.
• Custom trigger code. JavaScript you write yourself for Custom triggers runs in an isolated sandbox with a time and memory limit, on separate infrastructure from the app's own servers. It never sees the app's credentials or your Shopify access token. Its only path to your store is a short-lived token that is bound to your store and expires within a minute.
• Our team. Production systems are reached only through Google Cloud IAM with individual accounts. Internal maintenance tools are not exposed to the internet.

How we keep the app up to date

• Every change is scanned before it can ship. The pipeline runs type checks and linting, static application security testing (SAST), secret detection, dependency vulnerability scanning and container image scanning. Our release bar is zero known vulnerabilities in dependencies and in the image.
• Runtime and operating system. The container image, Node.js on its Alpine Linux base, is rebuilt with every release, so runtime and operating system patches ship continuously. The managed Kubernetes platform keeps the underlying nodes patched.
• Shopify platform. We track Shopify's API versions and the security advisories for Shopify's app libraries, and apply updates promptly. The app runs on a current Admin API version.
• Security reviews. An automated security audit runs before any change that touches authentication, sessions or data exposure, and we conduct a full internal review of every route, data path and database query at regular intervals, most recently in October 2026.
• Monitoring. Availability is monitored around the clock and published on our status page, and errors alert us. Operational logs are kept for at most 30 days and never contain tokens, secrets or customer data.

Retention and deletion

• Event history is deleted automatically after 30 days.
• The snapshots the app keeps to detect changes (the last known state of a product, order or customer) stay while the app is installed, because the next change is detected against them.
• When you uninstall the app, its access to your store is deleted immediately. Shopify's shop/redact request, which follows 48 hours after uninstall, erases the protected customer data and everything your custom trigger code stored.
• Shopify's mandatory privacy requests (customers/data_request, customers/redact and shop/redact) are handled automatically within the timelines Shopify sets.
• Sub-processors and the full retention schedule are in the privacy policy. A signed data processing agreement can be requested at workflow-trigger-extensions.app/dpa.

Reporting a security issue

If you believe you have found a vulnerability, or you need a security questionnaire completed, email support@codecreationlabs.com. Security reports are read and answered with priority.