Salexa
Trust

Security and data

Salexa works with your store's products every day, so we treat security as a feature. Here is how your data is protected.

Minimal permissions

Salexa requests only read_products, write_products, read_files and write_files. It never requests access to customers, orders or payments.

Encryption

  • All connections use HTTPS (TLS), with HSTS enabled.
  • Shopify access tokens are encrypted at rest with AES-256-GCM before they are stored. Each token is cryptographically bound to its own store, so it cannot be reused elsewhere.
  • Secrets live in our hosting provider's encrypted environment, never in code.

Store isolation

Every record belongs to exactly one store. Each database query is automatically restricted to the store of the verified Shopify session, and database constraints prevent records from referencing another store's data. Automated tests check that one store can never read or change another store's data.

Authentication

  • Every request from your admin is verified with a Shopify session token.
  • Every Shopify webhook is verified with its HMAC signature; unsigned requests are rejected.
  • Only *.myshopify.com store domains are accepted.
  • The app can only be embedded in your Shopify admin.

AI safety

  • Product content is passed to the AI as data, separated from instructions.
  • AI responses must match a strict format; anything else is rejected and never written to your store.
  • Generated HTML is sanitized with a strict allow-list before it is shown or published.
  • Per-store quotas protect against runaway usage.
  • Nothing is published without your approval, and every change can be reverted.

Deletion

Uninstalling Salexa deletes its access token immediately and cancels pending work. 48 hours later, Shopify sends an erasure request and every record stored for your store is permanently deleted. Salexa stores no customer data.

Operations

  • Logs are structured and never contain access tokens or product content.
  • Error messages shown in the app are generic; details stay in our private logs.
  • Dependencies are audited for known vulnerabilities before release.

Report a vulnerability

If you believe you have found a security issue, email security@salexa.app with steps to reproduce. Please do not access other merchants' data, run denial-of-service tests or disclose the issue publicly before we have fixed it. We will acknowledge your report and keep you updated.