Security policy

Last updated September 30, 2026

This policy describes how Mint Labs protects the data Mint Invoices handles, including personal data of merchants' customers processed on behalf of merchants. It applies to everyone at Mint Labs with access to our systems.

Data loss prevention

We keep as little data as possible. Customers' names, email addresses and addresses are read from Shopify only while a document is being made or emailed; they are never written to our database or logs, and PDFs are not stored.
The document register keeps document numbers, Shopify order and refund IDs, order numbers, dates and amounts. Issued numbers can't be changed or reused (enforced by the database).
Document links are signed with the app secret and expire after 10 minutes. A customer can only get a download link for an order that Shopify confirms belongs to their signed-in account.
Our database is Cloudflare D1: encrypted at rest, with point-in-time recovery so it can be restored to any minute in the retention window.
All traffic uses HTTPS (TLS). Production and development use separate databases; development uses fictional sample orders only.
Webhooks are verified with Shopify HMAC signatures, admin requests with Shopify session tokens; unsigned or invalid requests are rejected.

Access control

Only authorised Mint Labs personnel who need it to run and support the app can access production systems.
The app has no internal screen that lets us browse orders, documents or customers' personal data.
Access is removed immediately when it is no longer needed.

Passwords and authentication

Every account with access to production (hosting and Shopify Partner) uses a strong, unique password stored in a password manager.
Two-factor authentication is required on all of those accounts.
API secrets are stored as encrypted environment secrets, never in source code, and are rotated after any suspected exposure.

Logging

Every request to the app, including requests that process personal data, is logged with a timestamp by our hosting provider's request logs. Our own log lines never contain customers' names, email addresses, addresses or order contents.
Logs are reviewed when investigating errors or suspected incidents.

Security incident response

Report. Anyone can report a suspected issue to support@stickermint.com. We acknowledge reports within one business day.
Contain. We stop the exposure first: disable the affected feature, revoke and rotate keys and access tokens, and block abusive traffic.
Investigate. We use request logs and database history to find what happened, which shops and data were affected, and when.
Notify. If personal data was affected, we notify affected merchants without undue delay and within 72 hours of confirming the incident, and tell Shopify where required, with what happened and what we are doing about it.
Recover. We fix the root cause and, if needed, restore data from point-in-time recovery.
Review. We record each incident and the lessons learned, and update this policy.

Contact

Mint Labs — support@stickermint.com