What is in place, and what is not yet
Only controls that exist in our code or on our servers. If something is not done yet, this page says so.
Where we stand
No Caravel app is in production yet. They run on test servers, against a development store. So the controls below have not yet protected real customer data, and there is no uptime figure to show: we would have to make it up.
Application controls below apply to four apps, the ones that handle the most personal data: Caravel Invoice PT, Caravel Track, Caravel Reviews and Caravel Packing Slips. The other seven apps are not yet covered by this review or by the data processing agreement: they have neither field encryption nor the access log, and their installation sessions (the store's access token and the staff details Shopify supplies) are not yet encrypted.
| Control | How it works | State |
|---|---|---|
| Protecting data | ||
| Encryption at rest, field by field | AES-256-GCM on stored personal data and sessions. Key rotation is supported. Tests check that the database only holds encrypted text. Limit: Encrypted fields cannot be searched; the apps search by hash instead. | In the code |
| Encryption in transit | External connections over HTTPS/TLS and SMTP only with TLS. The apps only listen on the local address, behind HTTPS. | In the code |
| Keeping less | Invoice PT does not store the buyer's name, tax number, address or email. Packing Slips stores no buyer data, only the store's encrypted session. Track keeps the email only as a keyed hash (HMAC). | In the code |
| Automatic deletion | Track shipments after 90 days, Reviews buyer contacts after 90 days, exports after 30 days and Invoice PT data 30 days after uninstalling. Shopify's privacy webhooks erase or anonymise on request. | In the code |
| Backups | ||
| Encrypted backups in another country | Encrypted on the source server before being sent, scheduled daily to a server in another country. 14 daily and 4 weekly copies are kept. Limit: There is no automatic alert yet if a backup fails. | Running |
| Restore tests | A weekly automatic restore test checks every database. Last result: 30 October 2026, 9 databases, OK. These are the databases of the apps installed on the test server. | Running |
| Access and logs | ||
| Access log | Records who opened which admin page and when, without content. Kept for 365 days and erased with the store. Limit: It logs pages, not each field shown. | In the code |
| Server access | SSH by key only, firewall on, databases not exposed to the network. | Running |
| Logs without personal data | Emails, phone numbers, addresses, names, tax numbers and tokens are removed from application logs. | In the code |
| Verified origin | Webhooks and store proxy requests are checked with Shopify's signature (HMAC). | In the code |
| When something goes wrong | ||
| Incident response | Written policy: Shopify and the merchant within 24 hours, the Portuguese data protection authority within 72 hours when we are the controller, with a record and a review. | Adopted |
| Data processing agreement | A data processing agreement (Art. 28 GDPR) covers the four apps above. | Adopted |
| Production servers in the EU | The production hosting has not been chosen yet. Test servers are in the United Kingdom, backups in France. When it changes, Annex III of the agreement is updated. | Before launch |
Independent checks on the code
On 30 Oct 2026: 405 of 407 automated security checks ran with no findings on the Shopify apps measured, and both WordPress plugins passed Plugin Check with no errors or warnings. The other checks and the detail are in «How we test».
This website
- No cookies, no analytics and no advertising trackers.
- No scripts, fonts or images from other companies: the browser is told to load only from this site.
- A contact form that does not send anything to us: it just opens your own email app.
Read the documents
- Data processing agreement The companies that process data for us are listed in Annex III of the data processing agreement.
- Privacy policy
Found a problem?
Write to caravel@caravelsuite.com with the details. Please do not include customer data. We publish a security contact at /.well-known/security.txt.