RTOGuardRTOGuard handles your orders and your buyers' details. This page explains, in plain words, how we keep them safe. Every point here describes what the app does today.
Orders always go through
RTOGuard is built to fail open. It works after an order is placed and never sits in your checkout. If any part of RTOGuard has an error, the order goes through as normal. An RTOGuard problem never blocks a sale.
RTOGuard does not cancel orders on its own. An order is cancelled only when you choose it. Test mode scores and tags orders but sends nothing and cancels nothing.
Buyer data
- Buyer phone numbers used for risk matching are stored as one-way hashes (PBKDF2-SHA512, 100,000 iterations, with a per-store salt).
- The phone number itself is kept only while a call to that buyer is open, and, when the WhatsApp check is on (coming soon), to send the confirmation and match the reply. It is cleared once the buyer confirms or cancels, or the order is cancelled.
- Every view of a buyer's phone or address in the app is logged.
- We do not sell buyer data, use it for advertising or share it with other merchants.
Encryption
- Shopify access tokens and courier passwords are encrypted at rest with AES-256-GCM.
- All data travels over HTTPS/TLS.
- The database is Supabase PostgreSQL with TLS in transit.
Hosted in Mumbai, India
The database is hosted in AWS Mumbai (ap-south-1) through Supabase. The app runs on Vercel in its Mumbai region.
Verified webhooks
- Every webhook from Shopify, including the GDPR webhooks, is checked with an HMAC-SHA256 signature before RTOGuard acts on it. Unsigned or wrongly signed requests are rejected.
- Courier delivery updates are accepted only with your store's own webhook secret.
Read-only on ads
RTOGuard never creates, edits, pauses or publishes anything in an ad account. Today you type in your ad spend. The automatic Meta spend sync, coming soon, asks only for read access (ads_read) and makes read requests only.
Access and breaches
- Access to production systems is limited to the owner.
- Everyone at Impact Marvel who can access store data is bound to keep it confidential.
- If a breach affects your buyers' data, we tell you by email without undue delay and within 72 hours of becoming aware of it.
Deletion
When you uninstall, RTOGuard stops processing at once. Shopify sends a deletion request 48 hours later, and RTOGuard then permanently deletes all of your store's data. Buyer deletion requests from Shopify are handled automatically. Details on the data processing page.
Report a security issue
Found a problem? Email impactmarvelagency@gmail.com with the details. Please do not test against stores you do not own.