Security and data protection
How Indie Wholesale protects the personal data of the stores that buy through us. Last updated Oct 15, 2026. See also our privacy policy.
Encryption
- In transit. Every page and API call uses HTTPS (TLS). Calls to Shopify use Shopify's HTTPS API.
- At rest. All Indie Wholesale data, including store accounts and orders, lives on an encrypted volume (LUKS2, AES-256). Shopify access tokens are encrypted a second time inside it (AES-256-GCM).
- Backups. The database is backed up twice a day. Each backup is encrypted before it leaves the volume, with a key whose private half is kept offline and is not on our servers. Backups are kept 14 days on the server and 60 days at a second location.
What we keep, and for how long
| Data | Kept |
|---|---|
| Store accounts (email, store and contact name, phone, shipping address, resale number) | While the account is in use. After 36 months with no sign-in and no order, the personal details are removed. |
| Signed resale certificates behind a tax-free order | Kept indefinitely, as the brand’s sales tax record. |
| Orders | For the brand's and our accounting records. Orders hold what was ordered and the totals; the store's details are on its account. |
| Sign-in codes | Deleted a day after they expire. |
| Carts | Deleted after 12 months without change. |
| Invite links never opened | Email and store name removed after 12 months. |
| Activity and access logs | 24 months. |
| A brand's app data after it uninstalls | Tokens, settings and catalog deleted when Shopify asks (48 hours after uninstall). |
| Backups | 60 days. |
A daily job applies these periods automatically. A store can ask us to delete its account at any time.
Access
- Only authorized staff can reach the servers, by SSH key; password logins are turned off.
- The application runs as its own restricted system user and can only write to its own data volume.
- Every view or export of stores' personal data in our admin pages and in the brand's app is logged (who, when, how many records; never the data itself), and any direct opening of the database by a person on the server is recorded by the operating system's audit log.
- Brands see the details of stores that order from them, because they ship those orders. They never see other brands' stores.
Data loss prevention
- Encrypted, off-site backups twice a day; restores are tested.
- Personal data is not copied into logs, emails to staff, or spreadsheets; the only export (invite links for a brand's own campaigns) is admin-only and logged.
- Test and development use separate stores and separate databases with test data.
- We collect only what a brand needs to ship and invoice an order.
Security incidents
- Detect. Failed backups, unusual access and errors are reviewed; anyone can report a concern to support@indiewholesale.com.
- Contain. Revoke or rotate the affected keys and tokens (Shopify app secret, encryption keys, server keys) and take affected systems offline if needed.
- Assess. Work out what data, which brands and which stores were affected, using the access and audit logs.
- Notify. Tell affected brands and Shopify without undue delay and within 72 hours of confirming an incident, and affected stores where required, with what happened and what we are doing.
- Recover and review. Restore from encrypted backups if needed, fix the cause, and record what we changed.
Contact
Security questions or reports: support@indiewholesale.com.