Security

• Tenant isolation in the database. Every merchant's data is separated by row-level security in the database itself, and the application runs as a least-privilege role that cannot bypass it.
• An append-only ledger. Reward entries cannot be edited or deleted, only corrected by a further entry — enforced by the database, not by application code.
• Encryption. Traffic uses TLS 1.2 or 1.3 only, with HSTS. Store access tokens and webhook secrets are encrypted at rest with AES-256-GCM. Backups are encrypted before they leave our server, and the key that decrypts them is held offline.
• No passwords to steal. Merchants sign in with a one-time code sent by email, with rate limits on guessing. Our own staff console needs a separate sign-in with a second factor.
• Hardened web layer. A strict Content-Security-Policy with per-request nonces, framing refused everywhere except inside the Shopify admin, and signed, constant-time-verified webhooks in both directions.
• A full audit trail. Every configuration change and manual adjustment records who made it and when, and cannot be quietly rewritten.
• Hosting. The service runs in Mumbai, India; the third parties involved are listed on the sub-processors page.

How we handle personal data is set out in our privacy policy and, for merchants, the Data Processing Agreement.

If you believe you have found a security issue in StickyTier, please email security@stickytier.com with what you found, how to reproduce it, and what it could affect. We will acknowledge your report, keep you updated while we investigate, and tell you when it is fixed.

While you investigate, please:

• only test against your own account or store, never another merchant's programme or members;
• not access, change or keep data that is not yours, and stop as soon as you reach any;
• not run denial-of-service, spam or social-engineering tests against us, our merchants or their customers;
• give us a reasonable time to fix the issue before telling anyone else.

We do not currently run a paid bug bounty, but we are grateful for every report made in good faith.

Our security.txt has the same contact in machine-readable form.