Security

OfferOptics applies layered controls across Shopify authentication, retailer permissions, tenant-scoped data, connected-provider credentials, AI execution, and production infrastructure. Security controls are reviewed alongside product changes; this page states the current public posture and does not claim a certification that has not been awarded.

• Shopify-authenticated context establishes the retailer and administrator identity for embedded administration routes.
• Storefront requests use verified Shopify app-proxy or direct-route controls; browser or model-provided tenant fields are not trusted as authority.
• Private records include tenant ownership, and protected administrative actions require fresh server-side role and permission checks.
• Provider execution requires a registered adapter, a verified tenant connection, required credentials, capability access, and the applicable operation permission.

• Public application traffic is protected with HTTPS encryption in transit.
• Production PostgreSQL storage and backups are configured for encryption at rest.
• Supported provider credentials use envelope encryption with tenant, provider, connection, resource, and environment-bound encryption context.
• Plaintext credentials and OAuth tokens are not displayed after storage and are excluded from AI prompts, merchant-visible audit records, and public errors.
• Production credential writes fail closed when the required encryption service is not configured.

• Models classify, retrieve, summarize, or draft within code-owned contracts. Application code enforces authorization, source authority, data visibility, product validation, confirmations, and writes.
• The retailer-facing setup assistant can draft supported settings changes but cannot apply them without explicit confirmation and a fresh permission and state check.
• Credential, billing, role, security, privacy, retention, activation, and arbitrary provider-action fields are excluded from the assistant's writable setting contracts.
• Public failures return bounded messages while internal prompts, credentials, tokens, and provider payloads remain redacted.

• OfferOptics subscribes to Shopify's required customer data request, customer redaction, and shop redaction webhooks.
• Customer-linked exports exclude raw internal system prompts and integration credentials.
• Redaction removes matched customer context, conversations, recommendation decisions, and related tenant-scoped records supported by the application.
• Merchant-configurable retention is bounded by product and contract; uninstall disables active intelligence and connected-provider execution.

• Production infrastructure uses private database networking, encrypted storage, retained backups, health checks, logs, and deployment verification gates.
• Application release gates include TypeScript, schema, integration contract, tenant isolation, AI safety, browser, and regression testing appropriate to the change.
• Audit records capture governed administrative and provider operations while redacting secret and internal prompt fields.
• Live provider authorization, infrastructure permissions, model access, and environment health are verified separately from code-level test evidence.

Retailers control staff access, Shopify permissions, enabled products, connected providers, customer notices and consent, data sources, retention choices, approvals, and storefront actions. Retailers should grant least-privilege access, rotate provider credentials when needed, remove departed users, review audit and integration health, and report suspicious activity promptly.

Send suspected vulnerabilities or security incidents to support@offeroptics.com. Include the affected surface, reproduction steps, and impact. Do not include live customer data, passwords, API keys, or other secrets in the initial report.

Please act in good faith, avoid privacy violations or service disruption, and allow us a reasonable opportunity to investigate before public disclosure.