Security Overview

Last updated: 19 July 2026
Security contact: [email protected]

Compass Subscriptions is a subscription and loyalty application for Shopify stores, operated by Ecropolis LLC. This page describes how we protect merchant and customer data.

Our role

The merchant is the data controller for their customers’ personal data; we are a processor acting on their instructions. We do not use merchant data for our own purposes, and we do not combine data across merchants.

See our Privacy Policy and Data Processing Addendum.

Data minimisation

We hold the least we can operate on. For a merchant’s customers that is a Shopify customer identifier, email address, and name, plus the loyalty and subscription records the app generates.

We do not store payment card details, shipping or billing addresses, or order line contents. Payment methods remain in Shopify’s vault and are referenced by identifier only.

Webhook payloads are stored as a cryptographic hash rather than as content, so our delivery records contain no customer data at all.

Encryption

• All traffic is encrypted in transit using TLS.
• All data is encrypted at rest.
• Shopify access tokens receive an additional layer: each is encrypted with AES-256-GCM before it reaches the database, using a key held separately from the data. A copy of the database alone does not yield access to any merchant’s store.

Access control and isolation

Every record carries a store identifier, and every query is scoped to a single store. Cross-store access is prevented by design and covered by automated tests.

Access to the application requires an authenticated, cryptographically signed session bound to one store. Machine-to-machine endpoints require separate credentials and are absent entirely unless explicitly configured.

Internal access to production systems is limited to named personnel with multi-factor authentication.

Monitoring and detection

Reads of personal data are logged with the record accessed, the surface used, and the time. Search terms are recorded only as a length, never as a value, so the log itself holds no additional personal data.

Automated checks run continuously and raise alerts for unusual access volume, failed privacy-request processing, and event delivery failures. Alerts are recorded regardless of whether their delivery succeeds.

Data retention

Retention is enforced automatically rather than by policy alone:

Records connected to an outstanding loyalty balance or an active subscription are never removed automatically. Merchants may shorten these periods.

Privacy requests

We implement Shopify’s mandatory privacy webhooks. On a customer data request we report every record held for that customer. On a customer redaction we delete their member record, loyalty ledger, activity history, subscription records, and any queued events carrying their identifiers. On a store redaction we delete all data for that store.

These run automatically, and automated tests assert that no table containing customer data is missed.

Business continuity

Data is held in managed, replicated storage with point-in-time recovery. Our restore procedure is documented and has been tested against a non-production database, verifying both full recovery and the internal consistency of loyalty balances afterwards.

Change management

Every change passes automated type checking and a test suite before deploy. Database changes are additive, so a release can be rolled back without data loss. Production, development and test environments use entirely separate databases.

Sub-processors

We notify merchants before adding a sub-processor.

Certifications

We do not currently hold SOC 2 or ISO 27001 certification. We are happy to answer security questionnaires directly — contact [email protected].

Reporting a vulnerability

Email [email protected] with steps to reproduce. We aim to acknowledge within one business day. Please give us a reasonable opportunity to remediate before public disclosure. We will not pursue legal action for good-faith research that respects customer privacy and avoids service disruption.