How we keep data safe
Vikalp Omni runs inside your Shopify admin and on your store’s website. This page explains how we protect your store’s data and your customers’ data. For what we collect and why, see the privacy policy.
How data is protected
- Everything travels over HTTPS (TLS), and browsers are told to use only HTTPS (HSTS).
- Shopify access tokens and other secrets are encrypted at rest with AES-256-GCM, with a separate key for each purpose and keys that can be rotated.
- Each store’s data is kept apart: every read and write is tied to the store it belongs to.
- Database backups are taken daily by our hosting provider and kept for a limited time. A backup is restored only in an emergency, and every deletion recorded since is applied again straight after.
Every request is checked
- Requests from the Shopify admin carry Shopify session tokens; webhooks and storefront requests carry Shopify signatures, and we refuse any that don’t match or are too old.
- Rate limits protect sign-in and public endpoints.
- Security headers on every page: a Content-Security-Policy, frame protection and no content sniffing.
Who can see what
- In each store, the owner decides what every team member can see and change, area by area, and can hide customers’ names, emails and phone numbers from chosen people. Exports and campaign sends by team members ask for a fresh emailed code.
- Our own team signs in with company accounts, an emailed code and an authenticator app. Sessions end after 2 hours without activity. Every sign-in and access change is logged.
- Our team looks at a store only to help it, when the merchant asks. To work inside a store’s Shopify admin we use Shopify’s collaborator access, which the merchant approves and can remove at any time.
How we build and run it
- Every change goes through a reviewed pull request with automated tests.
- Dependencies are checked for known problems, and every change is scanned for leaked secrets and risky code.
- Errors are reported to us with personal details removed, and uptime is watched around the clock.
- We have a written runbook for incidents, and tell affected merchants without undue delay if their data is ever involved.
Shopify’s privacy rules
- We handle Shopify’s customer data requests, customer deletion requests and store deletion requests automatically. A store deletion is retried until it is done, and recorded with the time it finished.
- We ask only for the Shopify permissions a feature uses, and use customer data only to run the features a merchant switches on.
- We never handle card details: Shopify bills for plans and takes every payment at checkout.
What stands behind each claim
Each statement above is enforced in a named place and checked by automated tests that run on every change. An independent review of this public site (18 October 2026) found no vulnerability; it asked for this register, and for application-level testing, which is next.
| Claim | Where it’s enforced | How it’s checked | Last checked |
|---|---|---|---|
| Each store’s data is kept apart | Every database query carries the store’s id; requests are tied to a store by Shopify’s session token or signature before any data is read | Automated tests sign in as two stores and check that neither can read or change the other’s customers, chats, rewards or settings | 18 October 2026 |
| A visitor can only see their own order | Signed-in customers come from Shopify’s signed request; a visitor must give the order number and the email or phone on that order | Automated tests try another person’s order number and a mismatched email and get nothing | 18 October 2026 |
| Rewards can’t be issued twice | Every token or credit movement has a unique key and is written atomically; balances can’t go below zero | Automated tests repeat the same order, refund and redemption and check the ledger once | 18 October 2026 |
| Team members see only what they were given | Permissions are checked on the server for every call, including exports and messages, not only in the dashboard | Automated tests sign in as a limited member and are refused outside their areas; hidden contact details stay hidden in every export | 18 October 2026 |
| Exports and campaign sends need a fresh check | A team member enters an emailed code before downloading an export or sending a campaign; each one is written to the store’s activity log | Automated tests for the code, its 15-minute window and the log entry | 18 October 2026 |
| Secrets are encrypted at rest | Shopify tokens, app signing keys and connected-service keys are sealed with AES-256-GCM under a purpose-specific key that can be rotated | Automated tests seal, read back and rotate keys; a scan on every change looks for leaked secrets | 18 October 2026 |
| Webhooks and storefront requests are genuine | Shopify’s signature is checked on the raw body, stale requests are refused, and each webhook is handled once | Automated tests send bad signatures, old timestamps and duplicates | 18 October 2026 |
| Custom email HTML can’t run in the dashboard | Previews render in a sandboxed frame with scripts off | Automated tests of the preview frame’s sandbox | 18 October 2026 |
| Deletions are done and stay done | A store deletion is retried until it is done and recorded with its completion time; restoring a backup re-applies recorded deletions | Automated tests of the deletion record and the re-apply step; a restore drill is in our runbook | 18 October 2026 |
| App builds run in isolation | Each build runs on a fresh, temporary machine with the store’s own signing keys decrypted only for that run and never written to logs | Build logs are checked for secrets on every change; keys are write-only in the dashboard | 18 October 2026 |
Report a security problem
Email support@vikalpomni.com with “Security” in the subject. Tell us what you found and how to see it. We reply within 2 working days and keep you updated until it’s fixed.
Please don’t look at or change other people’s data, don’t disrupt the service, and give us a fair chance to fix the problem before telling anyone else. If you follow these rules, we won’t take action against you for your research.
Our contact details are also in security.txt.