Security practices
- Minimum access: use Shopify permissions and protected customer data only for the workflows authorized by the merchant.
- Tenant separation: scope application records and requests to the authenticated merchant store.
- Encrypted transport: protect data transmitted between users, Shopify, connected services, and Order Elite.
- Controlled access: restrict administrative access, protect secrets, and remove access when it is no longer required.
- Traceable actions: preserve audit events for order creation, payment release, integration handoff, and support investigation.
- Resilient processing: use validation, replay protection, bounded retries, backups, monitoring, and rollback procedures appropriate to the service.
Shopify and privacy controls
Order Elite uses Shopify authentication and session controls, verifies authenticated platform events, limits requested scopes, and handles Shopify's required privacy events. We minimize personal information in application logs and separate service environments and credentials.
Merchant responsibilities
Merchants should use individual Shopify staff accounts, apply appropriate roles, remove access promptly, review saved orders and charges, protect connected carrier and fulfillment accounts, and report suspicious behavior quickly.
Vulnerability reporting
Send a concise report to apps@firgelliauto.com. Include the affected surface, reproducible steps, and potential impact. Do not access customer data, disrupt service, use social engineering, or publicly disclose an unresolved issue.
Incident response
We investigate suspected incidents, preserve relevant evidence, contain affected systems, and notify affected merchants or authorities when required by law. Service-impacting information is posted on the status page.
Security certifications
Order Elite does not claim certification under a named security standard. Contact apps@firgelliauto.com for a current security question or vendor review.