Security policy

Last updated October 7, 2026

This policy describes how Mint Labs protects the data Mint Raw Material Inventory handles: merchants' materials, recipes and ledger, order line items and quantities, and the staff email addresses merchants enter for alerts. The app never reads customers' names, emails, phone numbers or addresses. It applies to everyone atMint Labs with access to our systems.

Data loss prevention

• We keep as little data as possible. Orders are read without customer fields and order notifications are trimmed to IDs. The app writes only the stock of the variants a merchant gives a recipe. The only email addresses it stores are the staff addresses a merchant enters for alerts and the store's contact email. Order records are deleted after 400 days.
• Every database query is scoped to the authenticated store, and every value a merchant types (names, quantities, notes, CSV files) is validated and passed as a bound parameter. CSV downloads are built so spreadsheet programs never run their contents as formulas; uploads are limited to 2 MB.
• Stock writes to Shopify use compare-and-swap and idempotency keys, so a retry or a concurrent sale can never apply a change twice or overwrite a newer number.
• Alert emails go only to addresses the merchant entered (or the store's contact email), and every email has a signed link that removes that address.
• Our database is Cloudflare D1: encrypted at rest, with point-in-time recovery so it can be restored to any minute in the retention window.
• All traffic uses HTTPS (TLS). Production and development use separate databases; development never uses real merchant or customer data.
• Webhooks are verified with Shopify HMAC signatures and admin requests with Shopify session tokens; unsigned requests are rejected. Internal background endpoints accept only calls signed with a key derived from the app secret.

Access control

• Only authorised Mint Labs personnel who need it to run and support the app can access production systems.
• The app has no internal screen that lets us browse merchants' data.
• Access is removed immediately when it is no longer needed.

Passwords and authentication

• Every account with access to production (hosting and Shopify Partner) uses a strong, unique password stored in a password manager.
• Two-factor authentication is required on all of those accounts.
• API secrets are stored as encrypted environment secrets, never in source code, and are rotated after any suspected exposure.

Logging

• Every request to the app is logged with a timestamp by our hosting provider's request logs. Our own log lines never contain email addresses or secrets.
• Logs are reviewed when investigating errors or suspected incidents.

Security incident response

1. Report. Anyone can report a suspected issue to support@stickermint.com. We acknowledge reports within one business day.
2. Contain. We stop the exposure first: disable the affected feature, revoke and rotate keys and access tokens, and block abusive traffic.
3. Investigate. We use request logs and database history to find what happened, which shops and data were affected, and when.
4. Notify. If personal data was affected, we notify affected merchants without undue delay and within 72 hours of confirming the incident, and tell Shopify where required, with what happened and what we are doing about it.
5. Recover. We fix the root cause and, if needed, restore data from point-in-time recovery.
6. Review. We record each incident and the lessons learned, and update this policy.

Contact

Mint Labs: support@stickermint.com