Security overview

Lyrakart Customer Mobile App · Last updated 27 October 2026

This page says what we do to protect merchant and shopper data, and where we are still working. It supports our Data Processing Addendum. We have no third-party audit or certification.

Where data lives

The app runs on one dedicated stack on our server (160.250.204.8): its own system user, its own PostgreSQL database and its own Redis. Test and development work use separate local databases and never production data.

Access control

Merchant staff sign in through Shopify. Inside the app, roles decide who can see and change what, sensitive actions can need approval, and changes are written to an append-only audit log. The first person to open the app after install becomes owner only if Shopify confirms they are the store's account owner; others wait for approval.
Production servers can be reached only by our server operator, by SSH. The operator list is kept in our access policy and reviewed every quarter and whenever someone leaves.
Store access tokens and other credentials are kept in an encrypted secret store. Shopify tokens expire and are refreshed automatically. The merchant companion app uses short-lived tokens tied to the staff member's role.
Every shopper request is limited to its own merchant's app and store.

Staff passwords and two-factor sign-in

Server access uses SSH keys, not shared passwords. Passwords for the tools we use must be unique, at least 14 characters, kept in a password manager and never shared or sent in chat or email.
Two-factor sign-in is required on the accounts that can reach production or customer data: the Shopify Partner account, the hosting account, the mail account, the domain registrar, the code host and the Apple and Google developer accounts.
Access is removed on the day someone stops needing it. The full policy is internal; this is the summary.

Encryption

Data in transit uses HTTPS (TLS).
Shopper email addresses used for matching are stored as one-way hashes; contact-form and newsletter addresses and prescription files are stored encrypted.
Personal data is encrypted by the application before it is written to the database: Shopify webhook and data-request message bodies, appointment bookings, quotes and contact messages. Lookups on these use keyed hashes, so the values are not searchable without our key. Store tokens are kept in an encrypted secret store and the admin session tokens are encrypted.
Not yet encrypted at application level: staff names and emails, and shopper-written community posts, chat and assistant messages.
Backups are encrypted before they leave the server.
The server disk itself is not encrypted. Protection of personal data at rest relies on the application-level encryption described above.

Data loss prevention

Backups: the database is dumped every night at 03:30 and checked by reading the dump back; uploaded files are archived every night at 03:15. Both are encrypted with age and kept 7 days on the server. A manual dump is taken before every release.
Restore: a database dump is restored with pg_restore into the app's own database; releases can be rolled back to the previous version in one command. Restores are tested when we change the backup process and at least once a quarter.
Off-site copy: the encrypted backups are copied every night to a second server that can only receive them, and kept there 14 days. A restore has been tested.
Preventing leaks: secrets are not copied off the server or committed to code; production data is not used for testing; exports are logged; deletion and retention jobs run automatically.
Logging of personal-data access: changes, exports and reads of personal data are logged. Each staff read of customer personal data (quotes, bookings, community and prescription queues, privacy reports, exports) writes an audit entry recording who, which records and why, before the data is returned. The audit log can be filtered to these entries.

Incident response (summary)

Anyone who suspects an incident writes to info@lyrakart.com or tells the incident lead at once.
The incident lead classifies it within 4 hours, contains it (rotate keys, disable accounts, block access, take a service down if needed) and keeps a written log with times.
If personal data is affected we tell the merchants concerned within 72 hours of confirming it, and tell Shopify through the Partner contact where its rules require. We tell regulators and shoppers where the law requires, or ask the merchant to, as controller.
After recovery we write a review with causes and fixes within 7 days and track the fixes to done.

Reporting a vulnerability

Write to info@lyrakart.com with the details. We reply within 3 working days and will not take action against good-faith reports.