MCPify

Security

Last updated 2026-10-26

This page describes how we protect the data MCPify handles (technical and organisational measures under Art. 32 GDPR) and what we do if something goes wrong. It is part of our data processing agreement.

1. Access control in the app

  • Every AI client uses its own connection with permissions per store area (read, change, delete), set by the store owner.
  • Customer data is off by default; while it is off, names, email addresses, phone numbers and addresses are removed from responses.
  • Admin API operations beyond the curated tools must be granted one by one; a deny list blocks operations completely.
  • Staff members who connect an AI client act with their own Shopify permissions; their consent lasts at most 7 days.
  • Requests are rate limited per connection.

2. Encryption

  • All connections use HTTPS (TLS).
  • The database and its backups are encrypted at rest by the hosting provider.
  • API keys, OAuth tokens, authorization codes and pairing codes are stored only as SHA-256 hashes.
  • Staff members' Shopify access tokens are additionally encrypted with AES-256-GCM.

3. Hosting and backups

  • Hosting: Render Services, Inc. (region Frankfurt, EU). App and database run in the EU.
  • The database can be restored to any point in time within the last 3 days.
  • Test stores with sample data are used for development and testing; production data is not copied into test systems.

4. Logging and data minimisation

  • Every AI request, including blocked ones, is written to an audit log the store owner can review and export.
  • Customer names, email addresses, phone numbers and addresses are removed from request arguments before they are logged.
  • Audit log entries are deleted after the retention period of the plan; responses kept for safe retries after 24 hours.
  • Theme file backups are kept for 90 days and at most 20 versions per file; the newest version of each file stays until uninstall.
  • All data of a store is deleted 48 hours after the app is uninstalled.

5. Organisation

  • Only the operator has access to the hosting, database, code repository and domain accounts.
  • These accounts are protected with strong, unique passwords and two-factor authentication.
  • Code changes go through pull requests and are tested before they are merged and deployed.

6. Security incidents

A security incident is any event that may have led to unauthorised access to, loss or disclosure of personal data. We then:

  1. Contain: stop the cause right away, for example by revoking keys and tokens, blocking connections or taking the service offline.
  2. Assess: work out which stores, data and people are affected, and how likely harm to them is.
  3. Notify: inform affected merchants without undue delay and within 48 hours of becoming aware, by email and in the app, with what happened, which data is affected, what we have done and what they should do. Shopify is informed as required by the Shopify Partner Program Agreement. Where we are the controller (merchant account data), we notify the supervisory authority within 72 hours if required.
  4. Fix and document: remove the root cause, restore data from backups if needed, and record the incident, its effects and the measures taken.
  5. Review: check afterwards whether our measures need to change.

7. Reporting a vulnerability

Found a security issue? Email legal@getmcpify.app. Please give us a reasonable time to fix it before disclosing it. We do not take legal action against good-faith reports.