Security & Trust one-pager
DeploTeka is a control plane that turns one Shopify app codebase into a fleet of dedicated, per-store custom-distribution apps in your own Partner org. The security model follows from that architecture: we automate what you would otherwise do by hand, in your accounts, at your direction — without ever holding your password and without pooling anything across clients.
Your Shopify credentials
- Your password never touches us. You pair the DeploTeka browser connector with your workspace, then log in on Shopify's own login pages. Your password is typed only there — it never passes through DeploTeka and is never stored by us, in any form.
- We hold a session, not a credential you typed. After you log in, the connector captures your Partner + Dev dashboard session and uploads it over TLS. It is sealed in an encrypted vault, is never written to logs or rendered into pages, and is used exclusively server-side to perform the actions you direct: creating and configuring apps in your Partner org, and reading the state needed to monitor them.
- Revocation is in your hands, twice over. Disconnect in the cabinet and we stop using and delete the sealed session. Or log out your sessions on Shopify's side — that instantly invalidates our stored copy, no matter what.
- No pooled "master" credentials, ever. Every client store gets its own dedicated app, created in your Partner organization. There is no shared app and no cross-client credential mixing — compromising or offboarding one store never exposes another.
Least privilege & change safety
- Scope intersection on every deploy. Configuration pushes reconcile requested scopes against what is allowed, so a deploy cannot silently broaden an app's access.
- Config changes are server-side and recorded. Fleet-wide configuration is applied through the sealed session by the platform itself — no ad-hoc CLI or browser session per store — and each change is recorded.
- Install links are revealed on demand, never embedded. A store's signed install link is fetched through an audited server round-trip only when you ask for it; it is never rendered into a page or written to a log.
Your merchants' shopper data (our processor role)
- The data is the merchant's; we process it on the merchant side's behalf. Each dedicated app's web pixel sends storefront events to the collection endpoint under our processor obligations — subject-matter, data categories, sub-processors, breach notice, and deletion are all in the Data Processing Agreement (/legal/dpa).
- Ingress is authenticated. Lifecycle webhooks (install / uninstall / scope change) are HMAC-verified; a bad signature is rejected, and an unknown shop never resolves to another tenant's identity.
- Merchant access tokens are held in transit, not in stock. If you use DeploTeka as install infrastructure, we receive the merchant's Admin API token at the moment of install, seal it, hand it to your backend, and destroy our copy the moment the merchant uninstalls or a newer token replaces it. We never call the Admin API with it, never return it to the cabinet, and never write it down — what appears in our own records is a fingerprint, not the token.
Tenant isolation & minimal collection
- Every cabinet read is tenant-scoped at the query layer. A signed-in operator can only ever see their own organization's apps, stores, and health — isolation is enforced in the data access path, not just the UI.
- We collect the minimum, and we track no one. The marketing site's "request access" form takes a work email and three multiple-choice answers — nothing more — and the endpoint is rate-limited with validation and size caps on every field. There are no third-party analytics, advertising, or tracking scripts on the site or the cabinet: just a session cookie and a theme-preference cookie, both first-party.
Transport & operations
- All traffic is over TLS, including pixel-to-endpoint traffic.
- Secrets (dashboard sessions, tokens) live in an encrypted vault — never in logs, never in client-visible pages.
- Hosting: an EU-based cloud infrastructure provider, with data hosted in the European Union.
- Backups run on a rolling schedule with the oldest copy no more than 7 days old, are verified on write rather than assumed, and are monitored — a backup that stops running raises an alert instead of being discovered during a restore.
Responsible disclosure
Found something? Email security@deploteka.com. We acknowledge within 2 business days, keep you informed, and won't pursue good-faith research conducted without harming tenants or data.
DeploTeka is not affiliated with or endorsed by Shopify. "Shopify" is a trademark of Shopify Inc.
No third-party attestation (SOC 2 / ISO 27001) is claimed at this stage; this page states only implemented behavior.