Trust & Infrastructure

Security Architecture & Data Boundaries

How Ancile secures merchant telemetry with least privilege, read-only permissions, and EU database infrastructure.

1. Read-Only Scope Architecture

Ancile requests read-only permissions only and declares no write scopes. It possesses no technical capability to alter, modify, or erase store products, orders, customers, or themes.

Active Read-Only Scopes:
read_orders, read_customers, read_customer_merge, read_shopify_payments_disputes, read_themes.

Notice on Staff Monitoring: The read_users scope is not requested. Ancile does not monitor staff account sessions or actions.

2. Authentication via Shopify App Bridge

Ancile runs embedded inside the Shopify admin. It maintains no separate merchant credentials, passwords, or API tokens. Sessions are authenticated on every request using Shopify App Bridge session tokens signed by Shopify.

3. Webhook Integrity (HMAC-SHA256)

Every incoming webhook from Shopify is verified cryptographically using HMAC-SHA256 with our private application secret before processing. Unsigned or mismatched payloads are rejected immediately.

4. European Union Database Infrastructure

Ancile operates its PostgreSQL database infrastructure in Frankfurt, Germany (EU region). Data is encrypted in transit via TLS 1.3 and encrypted at rest with AES-256. Automated encrypted backups are retained for 14 days for disaster recovery.

5. Billing & Payment Data Separation

All subscription charges are managed through the official Shopify Billing API and billed directly onto the merchant's periodic Shopify invoice. Ancile never sees, collects, or stores customer credit card details or payment credentials.

6. Automated GDPR Lifecycle

Ancile answers Shopify's mandatory GDPR endpoints (customers/data_request, customers/redact, shop/redact). When an app is uninstalled or a store disconnect is requested, all store telemetry, rules, and records are permanently erased from our database.