Outpost Apps
Security

Practical safeguards for merchant data.

We design our website and Shopify apps to limit data access, protect data in transit and keep payment handling inside Shopify.

Last updated: August 16, 2026

Encrypted connections

Our public website and service endpoints use HTTPS/TLS to protect data in transit between supported browsers, Shopify and our services.

Scoped Shopify access

Apps request Shopify permissions needed for their documented functionality. We apply least-privilege principles when designing access and internal service roles.

Payment separation

App subscriptions and credit packs are approved and billed through Shopify. Outpost Apps does not receive or store merchants' full payment card numbers.

Access controls

Administrative and technical controls are used to restrict production access to authorized people and service processes that need it.

Service providers

We assess the role of infrastructure, support and AI providers and share data only as needed to deliver, secure and support the services.

Deletion workflows

Our Apps respond to Shopify's mandatory privacy webhooks and handle merchant and customer data requests as described in our Privacy Policy.

Report a concern

Responsible vulnerability reporting

If you believe you found a security issue affecting our Site or Apps, email us with enough detail to reproduce and investigate it.

Email a security report

Please include

  • The affected URL, app and store context.
  • Steps to reproduce and observed impact.
  • Screenshots or a minimal proof of concept, without personal data.
  • A safe way to contact you for follow-up.

Do not access data that is not yours, disrupt service, use social engineering, or publicly disclose an unresolved issue. We do not currently operate a paid bug-bounty program.

No system is risk-free

These practices reduce risk but cannot guarantee absolute security. If we confirm a security incident involving personal data, we will investigate, mitigate and provide notices where required by applicable law. See our Privacy & Cookie Policy for data categories, retention and rights.