Security & Trust

Last updated: June 18, 2026

MockupFlow is a local-first desktop application. Most data — your designs, listings, and encrypted credentials — never leaves your machine. This page summarises the controls we apply to the limited data that does flow through our infrastructure (licensing and the offline webhook relay), and maps them to Shopify's Protected Customer Data requirements.

Encryption

API keys and OAuth tokens are encrypted at rest on your device (Fernet / AES-128-CBC) and never transmitted to us.
All network traffic uses TLS/HTTPS. Inbound webhooks are HMAC-verified before processing.
Backups of the relay infrastructure are encrypted.

Access control & least privilege

Relayed webhook events are scoped per licence — only your app can retrieve your events.
Administrative access to our backend is limited to authorised personnel under least-privilege, with strong authentication.
We request only the minimum marketplace OAuth scopes required (see Data & Permissions).

Data minimisation & retention

We process only what's needed to run licensing and deliver order events to your app.
Order webhooks are auto-deleted after 7 days; Shopify GDPR audit records are kept 7 years as required; design staging files auto-delete after 36 hours.
You can search, export, redact, set a retention period, or wipe local order data from Settings → Compliance.

Separation, logging & DLP

Test and production data are kept separate.
Access to relayed data is logged.
We apply data-loss-prevention practices to the relay backend.

Incident response

We maintain a security incident-response procedure (detect → contain → notify).
We notify Shopify of any suspected breach of Merchant Data within 24 hours, and supervisory authorities / affected parties within the timelines required by law (e.g. GDPR 72 hours).
Report a security concern: info@mockupflow.ai.

Sub-processors and their transfer safeguards are listed on the Sub-processors page. Data flows and retention detail are on the Data & Permissions page.

DRAFT — not a certification. Some Level-2 controls (e.g. application-level encryption of order PII at rest) are on our roadmap. Confirm current status with us before a formal review.