Who looks after security
Sunny Kumar runs SilverThink (a brand of HeySERP Marketing Services) and is responsible for the security of our website, apps and servers. Security reports go to support@silverthink.in, which is also listed in our security.txt.
Section 2How we protect our systems
- Encrypted connections: this website and our apps are served only over HTTPS, through Cloudflare, with an encrypted connection from Cloudflare to our server as well. Plain HTTP requests are redirected to HTTPS.
- Encrypted at rest: store access tokens are encrypted in our database (AES-256-GCM). Daily database backups are encrypted on our server before they're uploaded, and kept for 14 days. We've tested restoring from them.
- Nothing exposed that needn't be: our apps and their database accept connections only from the server itself, never from the internet.
- Sign-in: our server accepts SSH keys only, with password sign-in and root sign-in turned off. Only Sunny has access. Our admin needs a password and a one-time code from an authenticator app.
- Separation: each website and app runs as its own system user, and our admin reads app data through a read-only database account.
- Less data, less risk: each app asks Shopify only for the permissions it needs. Checkout data such as delivery addresses is read inside Shopify for that checkout only and never stored. See our privacy policy for exactly what we keep.
- Logs: web server request logs are kept for 14 days, every sign-in to our admin is logged, and so is every connection to our app database.
If something goes wrong
This is what we do when we learn of a security incident, such as someone getting access they shouldn't have:
- Contain it: straight away, we cut off the access, for example by removing keys or taking the affected app or page offline.
- Replace secrets: we replace anything the incident could have exposed, such as our Shopify app credentials, store access tokens, server keys and admin login.
- Find out what happened: we use our logs and backups to work out what was affected and whose data was involved.
- Tell you: if your store or your data is affected, we email you within 72 hours of confirming it, at your store's contact address, which we look up from Shopify at the time (we don't keep a copy). We say what happened, what data was involved, what we've done and anything you should do.
- Learn from it: we fix the cause, write down what happened and update this page if our practices change.
Report a security problem
If you think you've found a security problem in our website or apps, email support@silverthink.in with "Security" in the subject. We reply within 2 working days.
Please give us time to fix it before telling anyone else, and don't access other people's data, change anything or disrupt our services while testing. We won't take action against anyone who reports a problem to us in good faith.