by IT BRAIN

Security and incident response

Last updated October 28, 2026

How we protect data

All traffic uses HTTPS. The database (Neon) and its backups are encrypted at rest.
API keys from merchants are stored encrypted or hashed. Storefront requests are signed by Shopify.
Only IT BRAIN staff who run the app can reach production systems, with strong passwords and two-step login.
Requests to the app are logged by our host (Vercel). Test data is kept separate from production data.
Personal data is deleted on Shopify's request and when a store uninstalls, as described in the privacy policy.

Contain: within hours of finding a problem, we cut off the affected access (rotate keys, disable the affected feature or connection).
Assess: we find out what data, stores and customers were affected, using our host and database logs.
Notify: we tell affected merchants within 72 hours of confirming an incident that involves personal data, with what happened and what they should do, and inform Shopify where required.
Fix and review: we fix the cause, restore data from backups if needed, and record what we changed so it doesn't happen again.

Email support@itbrain.com.pk with "Security" in the subject. We reply within one business day.