How we take care of your shop’s data.
The short version: your shop’s data is walled off from every other shop. The AI gets a customer number, not the order’s name, email or address. Before it reads what a customer writes to you, Eturns takes out the email addresses, phone numbers, card numbers and street addresses it finds. And every decision is written down. The detail below is for whoever checks these things for you, and the legal wording is in our security policy.
Where your data goes
Orders, returns and messages come in from Shopify. Your shop’s data is stored in Mumbai, with Supabase on AWS. The app and its background jobs run on Render in Singapore. Requests to the AI go through the Vercel AI Gateway to the model providers behind it (xAI, OpenAI and Google), which aren’t tied to one region. Those requests never include the name, email or address on an order, and the email addresses, phone numbers, card numbers and street addresses a customer types are taken out of their message first. Emails to your customers go out through Resend. Error and usage tracking, with personal data removed, runs on Sentry and PostHog in the US. The Privacy Policy covers transfers between countries.
The controls, one by one
Six controls, one row each: what it does, whether it’s live today, where it’s enforced, and the page you can read to check it.
| Control | Status | Where enforced | Evidence | Reviewed |
|---|---|---|---|---|
| Per-shop isolationYour shop’s data is walled off from every other shop. Row-Level Security in the database is the main control on every shop-scoped table; checks in our code are a backup. | Live | Postgres, every shop-scoped table | Authorization and data isolation | |
| No order contact fields in model promptsRequests never include the name, email or address fields of an order or customer record; the customer is a stand-in ID (a sentinel ID). Text a customer writes (an email, a chat message, a review or a warranty description) goes through a redaction pass first: the email addresses, phone numbers, card numbers and street addresses it finds become placeholders, and so does the customer’s name where they sign with it or Eturns already knows it. | Live | The prompt builder, before the gateway | AI autonomy gates | |
| HMAC and idempotent webhooksEvery webhook from Shopify is verified before any work starts. A delivery that already finished is recognized and acknowledged; one that didn’t finish is run again rather than skipped. The three GDPR webhooks return 401 on a bad HMAC. | Live | Every webhook route, before any work | Authentication | |
| Decision trailEvery AI decision is written down with the model used, the prompt hash, the past decisions it compared against, every tool call, the action, the dollar amount and the reasoning. Kept for 7 years. A customer’s redaction request clears the reasoning and tool calls on their decisions. | Live | The decision log, one row per decision | Decision trail and idempotency | |
| Where data livesStored data is in Supabase on AWS ap‑south‑1 (Mumbai). The app and its background jobs run on Render in Singapore. | Live | Hosting regions, fixed per vendor | Subprocessors | |
| SOC 2No completed report yet. The controls above are what’s in place today. | Not yet | Nothing to show yet | What we do not have yet |
What we do not have yet
Eturns does not have a completed SOC 2 report. The controls that ship today are per-shop RLS, no order contact fields in model prompts, HMAC webhooks, and a decision trail kept 7 years.
Report a vulnerability
Found a security problem? Here’s how to tell us. Our response targets are in the disclosure policy.
- Email contact@eturns.app with [SECURITY] at the start of the subject.
- Say what you found, where, and how to reproduce it. Use sample data, never a real customer or merchant.
- We confirm we’ve got your report, look into it, and tell you when the fix is live.