Security and trust
Claims we can point at.
Security pages are easy to fill with badges. This one only contains things we can point at — in a document, or in what the application does and does not do.
What we can show you
Five things, each with something behind it.
NORTHMAST holds no security certifications and is not an official Shopify partner. What follows is what we can show you in writing.
- Merchant-controlled connections
- Every advertising connection is initiated by the merchant through the platform's own authorisation screen, covers only that merchant's own accounts, and can be disconnected by the merchant at any time.
- Reporting-only advertising use
- Advertising data is read for reporting inside the application. NORTHMAST creates and modifies nothing in a connected advertising account, and no Shopify order or customer data is ever sent to an advertising platform.
- European primary database region
- The primary database is hosted in a European Supabase project region. We do not claim that all supporting processing takes place exclusively within the EEA; the details are set out in the Data Processing Addendum.
- Encryption
- Advertising platform tokens are encrypted at rest with AES-256-GCM and are never stored in plain text. Data in transit is protected by TLS as provided by our hosting and database providers.
- Published legal documents
- Our Privacy Policy, Terms of Service and Data Processing Addendum are published in full, versioned and dated. Deletion requests are handled through a documented data deletion procedure.
What we do not claim
The absences, stated plainly.
A security page that only lists strengths is not a security page. These are the things merchants sometimes assume, and should not.
- We do not hold SOC 2, ISO 27001 or any other security certification.
- We are not an official Shopify partner.
- We do not claim that all supporting processing takes place exclusively within the EEA.
Documents
Everything above is written down.
Read the Privacy Policy, the Terms of Service and the Data Processing Addendum. Deletion requests follow the published data deletion procedure, and the technical description of the advertising integrations is on the About page.
Early access
Questions before you connect a store?
Ask them before you install anything. We would rather answer a hard question now than have you find the answer later.