🛡️ AIOM
Security
Effective June 12, 2026
How AIOM protects merchant and customer data, and how we respond to incidents.
Encryption
- All traffic is encrypted with TLS in transit; data is encrypted
with AES-256 at rest.
- Backups are encrypted and replicated across multiple availability zones.
- Shopify access tokens are encrypted with AES-256-GCM before storage.
Application security
- Shopify webhooks are HMAC-verified against the raw request body before any
processing.
- All database access uses parameterised SQL — no string-built queries.
- All write endpoints validate input with Zod schemas.
- CSV output is guarded against formula injection.
- A
frame-ancestors Content-Security-Policy prevents clickjacking.
- CORS is restricted to a host allowlist.
- Every access to personal data is logged (metadata only) to
pii_access_logs, retained 12 months.
Incident response
- Incidents are classified by severity: SEV-1 (data breach or full
outage), SEV-2 (degraded service or contained security issue),
SEV-3 (minor issue, no data impact).
- Affected merchants are notified within 72 hours of a confirmed
personal data breach.
- Breaches involving Shopify data are reported to Shopify via the Partner Dashboard.
Contact
Security or privacy concerns: privacy@aiomprofitguard.com