Data minimization
Products are synchronized for support knowledge. Orders are queried live after exact customer verification and are not retained locally. Serva requests email access only; name, phone, and address are outside the first-version scope.
Encryption
Public traffic uses HTTPS/TLS. Shopify offline tokens are encrypted before database storage. Database backups are encrypted before being written to disk and are verified while still encrypted at rest.
Access and audit
Tenant-scoped authorization prevents cross-workspace access. Protected-data access logs contain actor and outcome metadata plus a keyed one-way resource hash, never raw order references or customer emails. Logs expire after 180 days.
Environment and backup separation
The current environment is development-only and uses Shopify development-store data. Production merchants will use a separate runtime, database, credentials, encryption keys, logs, and backups. Development data is never copied into production or vice versa.
Response and reporting
Serva maintains documented detection, containment, investigation, recovery, notification, and post-incident review steps. Report a suspected issue to 524520968@qq.com.
Independent assurance
Serva has not yet received a third-party SOC 2, ISO 27001, or equivalent certification. This statement is intentionally transparent and does not claim independent assurance that has not occurred.