BulkBase security and incident response

Last updated: October 1, 2026

How data is protected

In transit: all traffic to the app uses HTTPS (TLS 1.2 or newer) with automatically renewed certificates. The app talks to Shopify only over HTTPS, and to its database server only over an encrypted (TLS) connection.
At rest: the database and stored files live on encrypted volumes (LUKS2, AES-256). Passwords for merchants' FTP/SFTP servers are additionally encrypted in the database.
Backups: the database is backed up daily. Backups are encrypted before they are written, kept for 14 days and then deleted.
Minimum data: the app only reads customer and order data when a merchant runs an import or export. Files are deleted after at most 30 days and import history after 90 days; merchants can delete both sooner in Settings.
Separate environments: development and testing use separate databases and Shopify development stores with generated data, never production data.

Access

Only the administrators of Twinfire Group SIA can reach the servers, and only with SSH keys; password logins are disabled.
Accounts for hosting, Shopify and email use strong, unique passwords and two-factor authentication.
Firewalls only allow web traffic and SSH, and the database server only accepts connections from the app's own server. Security updates are installed automatically.
Requests and jobs are logged with the store and time, so access to store data can be traced. Logs are kept for a limited time and contain no customer details.

Incident response

When we learn of a possible security incident, we:

Contain it: revoke or rotate the affected keys and tokens, block the access and keep the evidence.
Assess which stores and data are affected, and how.
Tell affected merchants without undue delay, and within 48 hours of becoming aware of a breach of their store's personal data, and tell Shopify where its terms require it. Where we are the controller, we notify the Latvian Data State Inspectorate within 72 hours.
Fix the cause, restore from backups where needed, and check that the fix works.
Write down what happened and what we changed, and review this policy.

Reporting a vulnerability

Please email janis@twinfireup.com with the details. We reply within two working days and don't take action against good-faith research that avoids harming stores or their data.