Security
Your store's data, handled with care
Where your data lives, who can see it, what Ivy does with it and what she never does. No vague promises: this is how Strathly works today.
Where it lives
In the EU, over HTTPS, with keys kept safe
Three facts that cover most security reviews.
Hosted in the EU
The app, the database and the files you upload run on Hetzner servers in the European Union.HTTPS everywhere
The dashboard, the storefront widget, the iOS app, and our calls to Shopify and OpenAI all travel encrypted.Shopify tokens encrypted
Access to your store expires every hour, is refreshed on our server only and is stored encrypted with AES-256-GCM.
Your team and your shoppers
The right people see the right things
Three roles, and you decide who has which
- Invite links expire after 7 days
- Passwords of 10 characters or more, stored hashed
- Repeated sign-in attempts are slowed down
Ivy checks it's really them
- Order changes by Ivy alone are off until you switch them on
- Then a shopper proves the order is theirs: signed in, or a code that expires in 10 minutes
- The chat is rate limited against abuse
- A shopper asks about an order: An order number alone is not enough to see it.
- Ivy asks for the email on it: The number and the email must both match the order in Shopify.
- Only then she shares it: No one can read another shopper's order by guessing numbers.
AI
What Ivy sees, and what she never does
Ivy's replies are written with OpenAI's models through the OpenAI API. Here is what that means for your data.
Only what she needs
Your catalog and knowledge, the conversation in front of her, and the order a shopper asked about. Nothing from other stores.Not for training
OpenAI's API terms say API data is not used to train their models unless the customer opts in. Strathly has not opted in.Guardrails you set
She never invents a discount code, never moves money unless you allow it, and hands off what your rules say is for a person.
GDPR
Privacy requests, handled through Shopify
Shopify forwards your shoppers' privacy requests to every app on your store. Here is what Strathly does with each one.
A shopper asks to be erased
Their details and their conversations with your store are deleted. Without a request, every conversation is deleted 24 months after its last message.A shopper asks for their data
Your owner and admins get an alert in the app and by email, and so does our support. You download everything we hold about that shopper as one file (their details and cached Shopify record, their conversations with notes and summaries, the orders tied to them, the codes they were sent) and answer them within 30 days.You uninstall the app
Your data is kept so a reinstall brings it back, until Shopify asks for it to be erased 48 hours later. Then the store is deleted, or, if you signed up on our website, only its Shopify data is erased and your account stays.
The smaller things, done properly
Signed webhooks
Every message from Shopify is checked against its signature first.Hashed invite links
Invite tokens and shopper codes are stored hashed, never in plain text.Files reduced to text
From an uploaded PDF or document, only the text is kept, not the file.Safe web imports
Page imports refuse private and internal addresses.Sessions that expire
Signed-in sessions end after 30 days without use.Owner-only actions
Disconnecting Shopify and deleting the store need the owner.Team activity
Invites, role changes, pauses and disconnects show in Settings › Team.Breach notice
If a breach affects your store, we tell you within 48 hours.
FAQ
Security questions
Where is my data stored?
On servers run by Hetzner in the European Union: the database, the app and the files you upload, such as your logo. The companies that help us run Strathly, and where they process data, are on our subprocessors page.
Is my store's data used to train AI models?
Strathly uses OpenAI's API to write Ivy's replies. OpenAI's API terms say data sent through the API is not used to train their models unless the customer opts in, and Strathly has not opted in. We never sell your data or share it with other stores.
Is Strathly SOC 2 or ISO 27001 certified?
Not today. This page describes what we actually do, and our data processing agreement sets out the security measures we commit to. If your review needs more, write to us and we will answer your questionnaire.
Who at my store can see conversations?
Everyone you invite: every role can read and answer every conversation. Admins also manage Ivy, knowledge, products, the team and billing, and only the owner can disconnect Shopify or delete the store.
How does Ivy make sure a shopper is who they say?
To look up an order she needs both the order number and the email on it. Before she changes an order on her own, which is off unless you allow it, the shopper must prove it is theirs: signed in to your store, or with a 6-digit code sent to the order's email that expires after 10 minutes.
How do I delete my data?
Delete your account in Settings › Account: if you are alone on the store, the store and its data go with it, right away (our account deletion page has the steps). When you uninstall the app, Shopify asks us to erase your store's data: we delete the store, or, if you signed up on our website, the data that came from Shopify while your account stays. When a shopper asks your store to erase their data, Shopify tells us and we delete their conversations too. Without any request, each conversation is deleted 24 months after its last message. Deleted data leaves our encrypted backups within 30 days. You can also write to us at any time.
In the docs
Set it up, step by step
- Privacy and shopper dataWhat the chat stores about shoppers, for how long (24 months), raw IPs cleared within hours, data requests through Shopify, the DPA and the AI provider.
- Shopify permissions, one by oneWhy Strathly needs each Shopify permission: products, pages, policies, shipping, markets, orders, customers, languages, themes. It never edits products, prices or themes.
Questions for your security review?
Write to us and a person answers within one business day. Or start your trial and see it for yourself.