Security and data protection

How FirstFrame Speed Check protects the store data it handles, and what we do if something goes wrong. Last updated 4 November 2026.

Only what is needed

The app asks Shopify for one permission, "read products", used only to find product and collection page addresses to test. It keeps no customer data. What it does keep is listed on the privacy page.

Encryption

In transit: every connection (the app inside Shopify admin, Shopify's API and webhooks, Google PageSpeed Insights, email) uses TLS.
At rest: data lives on Railway, which encrypts stored data, including volumes and their backups, with AES-256.

Access

A store's staff see only their own store, through Shopify's signed session tokens, checked on every request.
Shopify access tokens expire and are refreshed automatically. They are never shown in the app, written to logs or kept in source code.
Webhooks from Shopify are accepted only with a valid signature.
Operator access is limited to the owner, through a secret admin key, and is used only for setup and support. Operator accounts (hosting, Shopify Partners, email) use unique strong passwords and two-step verification.
Requests that read a store's data are logged (who, which store, what, when; never the data itself). The log is kept for 14 months.

Keeping, backing up and deleting

Test history is kept for up to 400 days and then deleted automatically.
The data volume is backed up by Railway (encrypted). Backups expire on Railway's schedule.
Uninstalling deletes the store's access tokens at once. Shopify's shop erase request deletes everything kept for the store.

If something goes wrong

Contain: rotate the affected secrets (app secret, admin key, hosting token) and revoke store access tokens if needed.
Assess: use the access log and hosting logs to find what was reached, which stores, and when.
Notify: tell every affected store and Shopify within 72 hours, with what happened and what they should do.
Fix and review: close the cause, restore from backup if data was lost, and write down what changed.

Report a security problem to adam@inlinex.com.sg.