Security & Compliance

Etchify is built for European shops with strict expectations on data handling. Here's exactly what we do — no Marketing fluff, just the technical commitments.

GDPR compliance

Data Processing Agreement (DPA) is part of the Shopify install agreement — no separate signature needed.
All three Shopify GDPR webhooks are implemented and live: customers/data_request, customers/redact, shop/redact.
Customer design data is retained as long as your shop is installed. On uninstall, all shop and customer data is deleted within 48 hours.
Customers can request a data export through your shop — we forward the response automatically via the Shopify GDPR webhook.

Built for Shopify alignment

Etchify is built against Shopify's Built-for-Shopify guidelines: GraphQL Admin API, embedded Polaris-based admin UI, Managed Installation with token exchange, mandatory webhook subscriptions, and the standard performance and accessibility criteria. The BFS badge is applied for at app-store submission.

Hosting & data location

Customer designs and metadata: Supabase (PostgreSQL, eu-north-1 Stockholm).
Render workers and image processing: Hostinger VPS, Frankfurt datacenter.
Marketing site (etchify.app) and edge routing: Vercel — region Frankfurt (fra1), delivered through the global edge network.

Encryption

At rest

At rest: PostgreSQL encrypted at the disk level (AES-256 via Supabase managed encryption). Object storage encrypted at the bucket level.

In transit

In transit: TLS 1.3 between client, Vercel edge, Supabase, and the Hostinger workers. No plaintext leaves the browser.

Security review process

Every release goes through OWASP Top 10-aligned review (auth, input validation, dependency audit). Critical incidents would be disclosed at security@etchify.app within 72 hours per GDPR Article 33.

Need a DPA copy or compliance documentation?

Email security@etchify.app for the full DPA, sub-processor list, or any compliance question.

security@etchify.app