Security

Workflow Webhooks is built and operated by Code Creation Labs. This page explains what the app is made of, where it runs, how your store's data is protected and how we keep everything up to date. It is written for store owners and for anyone filling in a security questionnaire. The legal side (privacy policy, data processing agreement, sub-processors) is on Legal & data protection.

What the app is built on

Layer	What we use
Application code	TypeScript on Node.js, a current long-term-support release. The admin pages, the endpoints that receive your webhooks and the workers that hand them to Shopify Flow are one code base.
Database and cache	PostgreSQL (Google Cloud SQL) and Redis (Google Cloud Memorystore)
Queue	An incoming call is accepted, queued in Google Cloud Pub/Sub and processed by a separate worker, so a burst of calls or a slow answer from Shopify never loses a delivery.
Hosting	Containers on Google Kubernetes Engine in Google Cloud region europe-west1 (Belgium, European Union). Databases, caches and queues are region-local.
Shopify integration	Shopify's official app libraries, Shopify Flow triggers and actions, and Shopify's webhooks
Your storefront	Nothing runs in your theme. The optional app proxy URL for browser calls (see CORS, the app proxy URL and browser calls) is served by Shopify on your own domain and verified with Shopify's signature.

There is no PHP, WordPress, Java or other runtime anywhere in the service. The app is listed on the Shopify App Store and passed Shopify's app review, which covers Shopify's security and protected customer data requirements.

How your data is protected

In transit. Every connection between your browser, Shopify, the systems that call your webhooks and the app uses TLS. The database, the cache and the queue have no public address: they are reachable only from inside our private network.

At rest. All databases and storage are encrypted at rest with keys we manage in Google Cloud KMS.

Field-level encryption on top. The most sensitive values get a second layer: your store's Shopify access token, each webhook's authentication secret and every secret you store for transform functions. Each value is encrypted individually with AES-256-GCM under a separate key in Cloud KMS, with automatic key rotation, and decrypted in memory only at the moment it is needed. Secrets are never written to logs and are never returned by the Developer API or to Sidekick.

Secrets. API credentials and keys of the service itself live in Google Secret Manager and are loaded when a service starts. They are not in the code, not in the container images and not in the build pipeline.

Data minimisation. The app asks for no access to your store's data on install: starting a Shopify Flow workflow needs no permission, and the app never reads products, orders or customers on its own. A delivery carries exactly the payload the calling system sent.

Who can access what

• Your store only. Every record carries the store it belongs to, and every query is scoped to the store that was authenticated. One store can never read or change another store's webhooks or deliveries, and a synchronous response is keyed to the store that asked for it.
• Verified requests only. Pages inside the Shopify admin are authenticated with Shopify session tokens. Flow callbacks and Shopify's own webhooks are verified by Shopify's HMAC signature, and internal messages by Google-signed identities, before any data is touched.
• Your webhooks, your rules. Each webhook URL is unguessable, and you choose how callers prove themselves: a static token, an HMAC signature over the body, or none for sources that cannot sign. An optional IP allowlists restricts callers further; the caller's address is taken from the network connection, not from a header, so it cannot be forged. Duplicate deliveries are recognised and processed once. See Authentication.
• Transform functions. JavaScript you write for Transform functions runs in an isolated sandbox with a time and memory limit, on separate infrastructure from the app's own servers. It never sees the app's credentials or your Shopify access token, and its outbound requests are checked against private network ranges before connecting.
• Outbound requests. URLs the app calls on your behalf, for Scheduled URL polling and for Calling a webhook from Flow, are checked before connecting: loopback, link-local, cloud metadata and private network addresses are refused, including through a redirect.
• Our team. Production systems are reached only through Google Cloud IAM with individual accounts. Internal maintenance tools are not exposed to the internet.

How we keep the app up to date

• Every change is scanned before it can ship. The pipeline runs type checks and linting, static application security testing (SAST), secret detection, dependency vulnerability scanning and container image scanning. Our release bar is zero known vulnerabilities in dependencies and in the image.
• Runtime and operating system. The container image, Node.js on its Alpine Linux base, is rebuilt with every release, so runtime and operating system patches ship continuously. The managed Kubernetes platform keeps the underlying nodes patched.
• Shopify platform. We track Shopify's API versions and the security advisories for Shopify's app libraries, and apply updates promptly. The app runs on a current Admin API version.
• Security reviews. We conduct a full internal review of every route, data path and database query at regular intervals, most recently in October 2026.
• Monitoring. Availability is monitored around the clock and published on our status page, and errors alert us. Operational logs are kept for at most 30 days and never contain tokens or secrets.

Retention and deletion

• Delivery history stays while the app is installed, so that you can inspect and replay calls, and you can delete entries at any time. Headers that could carry credentials are masked before a delivery is stored.
• When you uninstall the app, its access to your store is deleted immediately. Shopify's shop/redact request, which follows 48 hours after uninstall, erases the store's remaining data, including everything your transform functions stored.
• Shopify's mandatory privacy requests (customers/data_request, customers/redact and shop/redact) are handled automatically within the timelines Shopify sets.
• Sub-processors and the full retention schedule are in the privacy policy. A signed data processing agreement can be requested at workflow-webhooks.app/dpa.

Reporting a security issue

If you believe you have found a vulnerability, or you need a security questionnaire completed, email support@codecreationlabs.com. Security reports are read and answered with priority.