Security Overview

1. In short

Conscription is a Shopify app. It runs inside Shopify's admin, sells through Shopify's checkout, and relies on Shopify for authentication and payments. That shapes everything below: the sensitive things a subscriptions app could get wrong — holding card numbers, running its own checkout, storing passwords — are things we deliberately do not do at all.

This page describes what is actually implemented today. Where something is not in place, it is listed in section 7 rather than left unsaid.

2. Where it runs

• The application, the renewal worker, and the PostgreSQL database run on infrastructure operated by Arched Group Ltd in the United Kingdom.
• All traffic is served over HTTPS. Plain HTTP requests are redirected to HTTPS; there is no unencrypted fallback.
• Your store data stays inside Shopify. What we hold is described in our Privacy Policy, and the companies involved are named in the sub-processor list.
• We run in a single region with a single primary database. See section 7.

3. Access and separation between shops

These are the controls that keep one merchant's data away from another's:

• No passwords. Merchants sign in through Shopify OAuth. We never create, store, or verify a password.
• Every webhook is verified before it is read. Shopify's signature is checked first; an unsigned or mis-signed request is rejected without its body being processed.
• Every storefront and customer-portal request is signature-checked. Requests arrive through Shopify's app proxy, which signs the shopper's identity and time-limits the signature, so a shopper's identity cannot be forged or a request replayed later.
• Every admin page authenticates on its own. Authentication is not inherited from a parent layout, so no page can be reached by routing around one.
• Every query is scoped to one shop. Records are looked up by shop together with their own identifier, never by identifier alone. Customer portal actions additionally check that the subscription belongs to the signed-in shopper.
• Least-privilege Shopify scopes. We request only the permissions the features you use actually need, and the app tells you when a permission is missing rather than failing quietly.
• Public endpoints are rate-limited per caller, with a shop-wide ceiling behind it, so one abusive visitor cannot exhaust a store's capacity.

4. Payment data

Card numbers, CVVs and payment credentials never reach Conscription. Shopify stores payment methods and charges them. When a subscriber needs to update their card, we send them to Shopify's own hosted payment-update page — we never collect card details ourselves, in the app or in the customer portal.

Merchant billing for the app itself is handled by Shopify App Pricing, so your payment details for us are held by Shopify too.

5. Your data, and getting it back

• Export. Subscriptions, analytics and activity logs can be exported to CSV from the app at any time, without asking us.
• Deletion. We implement Shopify's three privacy webhooks — customer data request, customer redaction, and shop redaction — so a request made through Shopify reaches us automatically.
• Uninstall. Uninstalling marks the shop inactive and removes or anonymises the data the app holds. Because Conscription runs your subscriptions, uninstalling stops them being managed — pause or move them first.
• Minimisation. Protected webhook payloads are sanitised before anything is stored, logs exclude secrets and payment data, and access tokens are never placed in anything the browser can read.

Retention, legal basis and your rights are covered in the Privacy Policy.

6. How we build

• An automated suite of over 3,500 tests, plus type checking and linting, runs before anything ships. A release that fails any of them does not go out.
• Dependencies are audited for known vulnerabilities as part of that same gate.
• Security fixes are written with a test that reproduces the problem first, and that test is kept afterwards so the same fault cannot return.
• The app talks to Shopify through its current GraphQL Admin API only, and changes your storefront through a Shopify theme app extension — never by injecting scripts or editing your theme files.
• Database changes ship as versioned migrations, applied on deploy.

7. What we don't have yet

We would rather you learn this here than discover it during a review. As of the date above, Conscription does not have:

• an independent penetration test or any security certification (no SOC 2, no ISO 27001);
• a published uptime commitment or service-level agreement — we do not have enough operating history to promise one honestly;
• multi-region hosting, automated failover, or a published recovery-time objective;
• SAML/SSO, SCIM provisioning, or custom staff roles inside the app (merchant staff authenticate through Shopify);
• a public status page.

If any of these is a requirement for you, please say so before you buy — email us and we will tell you honestly where it sits, rather than after you have signed up.

8. Reporting a security problem

If you believe you have found a vulnerability, email support@conscription.co.uk with the subject "Security disclosure". Please include enough detail to reproduce it, and give us a reasonable opportunity to fix it before disclosing publicly.

We will acknowledge your report within one business day, keep you updated while we investigate, and credit you if you would like to be credited. We will not pursue legal action against anyone who reports a problem in good faith, avoids accessing or altering other people's data, and does not degrade the service for others. We do not currently run a paid bug-bounty programme.

9. Contact

Security questions, security questionnaires, and data processing agreements: support@conscription.co.uk. See also our Privacy Policy, Terms of Service and Support Policy.

Arched Group Ltd is a company registered in England & Wales, company number 17408589. Registered office: Harrison House, Sheep Walk, Langford Road, Biggleswade, SG18 9RB.