Security & Data Protection

Security

PrintKit runs on your storefront and touches your customers' data, so protecting that data is built into how the app works — not bolted on afterward. This page explains, in plain language, the commitments we make to every merchant who installs PrintKit and to their shoppers. Every statement here reflects how the app is actually built and operated.

Minimal by design

We collect only what an order needs — no payment details, and a phone number or delivery address only when the order itself requires one.

Encrypted end to end

AES-256-GCM at rest with a separate key per store; TLS + HSTS in transit.

Isolated per store

One store's data can never be read by another — enforced with cryptography, not just rules.

Auditable & deletable

Every access to personal data is logged, and your data is fully purgeable on request.

Data minimization

PrintKit is deliberately data-minimizing: it stores only what it needs to produce a job and hand it to your bench. For a custom order that means the design file and its settings (size, product, color, placement and options), plus the customer name and email the shopper submits so you know who ordered what — and, when the order calls for them, a phone number and a delivery address.

What PrintKit holds, and what it never does:

• A phone number or a delivery address only when the order needs one — a shopper may add a phone on the quote form, and a card checkout collects a delivery address so you can ship. Neither is required. Both are encrypted at rest with your store's own key, shown only to you on your work ticket and Production Pack, and every time one is opened it is written to your access log.
• Payment or card details — never. On Shopify, payment happens inside your own Shopify checkout. Anywhere else, card payment runs on your Stripe account through Stripe's hosted checkout, or the order arrives as a quote and you collect payment the way you already do. In every case the card data goes straight from the shopper to Stripe: PrintKit never sees a card number, CVV, or bank detail.

Collecting less is the simplest protection there is: data we don't hold can't be exposed.

Encryption

At rest, customer personal data — the shopper's email, their phone and any note they leave, their delivery address, their saved design state, and uploaded artwork — is encrypted with AES-256-GCM. Each store gets its own separate encryption key, so protection is scoped to a single merchant rather than shared across the platform.

In transit, all traffic is served over HTTPS/TLS, with HSTS enabled so browsers refuse to connect any other way. There is no plaintext path to the application.

Tenant isolation

PrintKit is multi-tenant, and keeping stores separated is a hard boundary. Each merchant's data is scoped to their own store, and because every store is encrypted under its own key, that separation is cryptographic — not just a logical filter. One store's data simply cannot be read using another store's key. A merchant can never see another merchant's configuration, designs, or orders.

Access logging

Every time customer personal data is accessed — decrypting an email or reading a customer name into a work ticket, PDF, export, or draft order — PrintKit writes an append-only audit entry. The log records metadata only (which store, which field, the purpose, and when) and never the personal data itself, so the audit trail cannot become a second copy of the data it protects. These entries are retained for 90 days.

Backups & restore testing

PrintKit takes encrypted backups daily — of the Shopify app and the standalone edition alike — protected with a dedicated backup key kept separate from the key that protects live data, so a stolen backup is useless without it. Backups aren't assumed to work: an automated restore test runs every week on each edition. It restores the most recent backup into a throwaway database and checks that real store records come back — not merely that the archive opens — and a failed test raises an alert. Our most recent verified restore was 9 September 2026. Backups are retained for 14 days.

Retention & deletion

• You choose the retention window. Saved shopper designs auto-delete after 7, 30, or 90 days — your choice in setup — and an automated purge enforces it.
• Uninstalling erases everything. Uninstalling immediately ends your subscription and cuts off PrintKit's access to your store. The data itself is erased when Shopify sends its shop/redact request, which Shopify issues about 48 hours after uninstall— at that point the store's print files, designs, order records and its encryption key are destroyed. Because the data was only ever readable with that key, destroying it (crypto-shredding) makes any remaining ciphertext permanently unrecoverable. If you want it gone sooner, email us and we will run the deletion by hand.

Privacy requests (GDPR)

PrintKit handles Shopify's mandatory privacy webhooks automatically — the customer data request, customer redact, and shop redact flows — so data-access and erasure requests —customers/redact and shop/redact— are actioned without manual steps. A customers/data_request (an access request) is received and logged the moment it arrives, and we work with the merchant to supply the data, because the merchant is the controller and decides what is disclosed to their own customer. Every such request is written to an internal audit trail so we can demonstrate it was received and honored.

Shoppers who want their data deleted should contact the store they ordered from; the merchant triggers deletion through Shopify, which reaches PrintKit through these webhooks. Merchants can also request deletion directly at the address below.

Incident response

PrintKit maintains a written incident-response policy. If a data incident affects your store, we will notify you without undue delay after becoming aware — targeting within 72 hours — with the information reasonably available to help you meet your own obligations, and we cooperate with Shopify's incident processes. Incident contact: support@printkit.tech.

How this is governed

Everything above is governed by a formal internal Data Protection & Data Loss Prevention (DLP) Policy that is reviewed at least annually, and after any material change to how we handle data, encryption, or hosting. It is the control document behind the answers PrintKit gives for Shopify's Protected Customer Data requirements.