Security and trust
Claims we can point at.
Security pages are easy to fill with badges. This one only contains things we can point at — in a document, or in what the application does and does not do.
What we can show you
Seven things, each with something behind it.
NORTHMAST holds no security certifications. What follows is what we can show you in writing.
- Merchant-controlled connections
- Every advertising connection is initiated by the merchant through the platform's own authorisation screen, covers only that merchant's own accounts, and can be disconnected by the merchant at any time.
- Reporting-only advertising use
- Advertising data is read for reporting inside the application. NORTHMAST creates and modifies nothing in a connected advertising account, and no Shopify order or customer data is ever sent to an advertising platform.
- European primary database region
- The primary database is hosted in a European Supabase project region. We do not claim that all supporting processing takes place exclusively within the EEA; the details are set out in the Data Processing Addendum.
- Encryption and access
- Advertising platform tokens are encrypted at rest with AES-256-GCM and are never stored in plain text. Connections to the app and to our website are encrypted in transit with TLS. Every database read and write is scoped to a single store, and access to our internal operator console requires multi-factor authentication.
- Daily database backups
- The service includes a daily backup of the database, and each backup is kept for 7 days. Backups exist to restore the service after an incident, not to recover records or files you deleted yourself. Data deleted from the app can remain in a backup until that backup expires. Uploaded files are not part of these backups.
- Incident handling
- If a personal data breach affects data we process on your behalf, we notify you without undue delay and give you the information reasonably available to us, as set out in the Data Processing Addendum.
- Published legal documents
- Our Privacy Policy, Terms of Service and Data Processing Addendum are published in full, versioned and dated. Deletion requests are handled through a documented data deletion procedure.
What we do not claim
The absences, stated plainly.
A security page that only lists strengths is not a security page. These are the things merchants sometimes assume, and should not.
- We do not hold SOC 2, ISO 27001 or any other security certification.
- We do not claim that all supporting processing takes place exclusively within the EEA.
- We do not back up the files you upload: a file you remove or replace cannot be recovered.
Documents
Everything above is written down.
Read the Privacy Policy, the Terms of Service and the Data Processing Addendum. Deletion requests follow the published data deletion procedure, and the technical description of the advertising integrations is on the About page.
Launch status
Questions before you connect a store?
Ask them before you install anything. We would rather answer a hard question now than have you find the answer later.