Security and Incident Response

1. How we protect data

Encryption. All traffic uses HTTPS/TLS. Data is stored in Google Cloud Firestore, which encrypts data at rest. Third-party access tokens (Shopify, Meta) are additionally encrypted with AES-256-GCM before storage.
No client database access. Database rules deny all direct browser access. Every read and write goes through our servers, which check that the signed-in admin belongs to the brand.
Least privilege. Production access (database, hosting, deploys) is limited to Sqwad's founder. Brand admins only see their own brand's data; creators only see their own records.
Minimum data. We collect only what the creator program needs. For Shopify we don't read or copy the store's customer records; we store only the order ID and tracking for sample orders we created.
Retention. Denied applications are deleted 12 months after the decision and expired admin invites after 30 days, by an automated daily job. Disconnecting Shopify or Meta deletes credentials and synced data immediately.
Test data. Testing uses Shopify development stores and clearly labeled test brands.

If we suspect a security incident (unauthorized access, data exposure, or a compromised credential):

1. Contain. Revoke or rotate affected credentials and tokens, disable affected access, and block the cause.
2. Assess. Determine what data and which brands, creators or customers are affected, using hosting and database logs.
3. Notify. Tell affected brands without undue delay and within 72 hours of confirming the incident, and notify connected platforms (such as Shopify) and authorities where required.
4. Recover. Fix the root cause, restore any affected data, and confirm the fix.
5. Review. Write up what happened and what changes prevent a repeat.

Report a suspected vulnerability or incident to thomasosayi@gmail.com. We aim to respond within one business day.