Security and incident response
Last updated 2026-09-12. How Overture protects merchant and shopper data, and what happens if something goes wrong.
How data is protected
- In transit: every connection to Overture, Shopify, Klaviyo and Anthropic uses TLS. Storefront requests are signed by Shopify and verified before they are read.
- At rest: the database and its backups are encrypted by the hosting provider. Merchant API keys and Shopify refresh tokens are additionally encrypted by the app (AES-256-GCM) with a key that exists only in the production environment.
- Least data: the app stores no names, addresses, payment details or order line items. Order webhooks are logged without customer fields.
- Access: production access is limited to the operator, protected by two-factor authentication. Reads of shopper data through the app are logged with who, what and when.
- Separation: development runs against local databases and a separate development app; production data is never used for testing.
- Deletion: uninstall, shop-redaction and customer-redaction requests from Shopify are processed automatically, and every webhook is kept as an audit record without identifiers.
Incident response policy
- Detection. Application logs and hosting alerts are monitored. Anyone can report a concern to support@overture.lol; reports are acknowledged within one business day.
- Triage (within 24 hours). Confirm whether personal data was involved, which stores are affected, and whether the issue is ongoing.
- Containment. Revoke or rotate affected credentials, take the affected component offline if needed, and preserve logs.
- Notification (within 72 hours of confirmation). Affected merchants are told what happened, what data was involved, what we did, and what they should do. Where the law requires, authorities are notified in the same window. Merchants are responsible for onward notice to their shoppers and we provide the details they need to do it.
- Recovery and review. Restore service, verify data integrity, and publish a short post-incident summary to affected merchants with the fix and the steps taken to prevent recurrence.
Reporting a vulnerability
If you believe you have found a security issue in Overture, email support@overture.lol with enough detail to reproduce it. We will not take action against good-faith research that avoids accessing other people's data.