Security at Code Creation Labs

This page applies to every app we make: Workflow Trigger Extensions, Workflow Webhooks, Workflow Transactional Email, Workflow Functions, Workflow Suite, Workflow Forms and Workflow Documents. It explains what they are built on, where they run, how your store's data is protected and how we keep everything up to date. It is written for store owners and for anyone filling in a security questionnaire. Each app's privacy policy and data processing agreement are linked at the end.

What our apps are built on

Layer	What we use, in every app
Application code	TypeScript on Node.js, a current long-term-support release. One code base per app, from the admin pages to the background workers.
Database and cache	PostgreSQL (Google Cloud SQL) and Redis (Google Cloud Memorystore)
Hosting	Containers on Google Kubernetes Engine in Google Cloud region europe-west1 (Belgium, European Union). Databases, caches and file storage are region-local.
Shopify integration	Shopify's official app libraries, the Admin GraphQL API, and webhooks delivered through Google Cloud Pub/Sub
Your storefront	Nothing runs in your theme unless you add it yourself: the optional web pixel of Workflow Trigger Extensions and Workflow Suite runs inside Shopify's pixel sandbox (no access to the page, installed only when you switch a storefront trigger on), and the Workflow Forms theme block, popup and form page are a Shopify theme app extension whose script is a fixed file we ship; every merchant text it shows passes an allow-list that admits no script, style or event handler.
PDF rendering (Workflow Documents)	A Chromium-based renderer (Gotenberg, written in Go) that is reachable only from inside our cluster

There is no PHP, WordPress, Java or other runtime anywhere in our services. When a vulnerability in one of those is in the news, it cannot affect our apps and there is nothing you need to do. When it concerns Node.js, PostgreSQL, Redis or a library we use, the process under "How we keep the apps up to date" applies. You are always welcome to send an advisory to support@codecreationlabs.com and we will confirm in writing whether it applies.

Security advisories and whether our apps are affected

When a vulnerability or an attack involving Shopify apps is in the news, we check it against every app we make and record the result here, so you can file the answer instead of asking.

Advisory	When	Our apps	Details
PHP2Shell (CVE-2026-109618, CVE-2026-109619): remote code execution in the PHP engine	21 October 2026	Not affected. None of our apps contain PHP.	Statement
Shopify checkout hijack campaign: scripts injected through the storefront code of third-party apps (Hulk Product Options, Selleasy, Swym Wishlist Plus; Qikify in July) redirected shoppers to fake checkout pages	10 to 14 October 2026	Not affected. None of our apps was involved, and none of them can place a script of this kind in your storefront.	Statement

How your data is protected

In transit. Every connection between your browser, Shopify and our apps uses TLS. Databases and caches have no public address and are reachable only from inside our private network.

At rest. All databases and storage are encrypted at rest with keys we manage in Google Cloud KMS.

Field-level encryption on top. The most sensitive values get a second layer: your store's Shopify access token, credentials you enter (for example the mail server password in Workflow Transactional Email), and the protected customer data some opt-in features read. Each record is encrypted individually with AES-256-GCM under a separate key per app in Cloud KMS, with automatic key rotation. Values are decrypted in memory only at the moment they are used and are never written to logs.

Secrets. API credentials and keys live in Google Secret Manager and are loaded when a service starts. They are not in the code, not in the container images and not in the build pipeline.

Data minimisation. Each app asks for the narrowest Shopify permissions its features need. Several ask for no data access at install and let you grant each kind of data per feature, with a revoke at any time.

Who can access what

• Your store only. Every record carries the store it belongs to, and every query is scoped to the store that was authenticated. One store can never read or change another store's data.
• Verified requests only. Pages inside the Shopify admin are authenticated with Shopify session tokens. Webhooks and Flow callbacks are verified by Shopify's HMAC signature, storefront requests go through Shopify's signed app proxy, and internal messages are verified by Google-signed identities, before any data is touched.
• Your own code. Where an app runs code you write (Workflow Functions, custom triggers in Workflow Trigger Extensions, code steps in Workflow Suite), it runs in an isolated sandbox with a time and memory limit on separate infrastructure, never sees our credentials or your Shopify access token, and reaches your store only through a short-lived token bound to your store.
• Our team. Production systems are reached only through Google Cloud IAM with individual accounts. Internal maintenance tools are not exposed to the internet.

How we keep the apps up to date

• Every change is scanned before it can ship. Each app's pipeline runs type checks and linting, static application security testing (SAST), secret detection, dependency vulnerability scanning and container image scanning. Our release bar is zero known vulnerabilities in dependencies and in the image.
• Runtime and operating system. Container images (Node.js on Alpine Linux) are rebuilt with every release, so runtime and operating system patches ship continuously. The managed Kubernetes platform keeps the underlying nodes patched.
• Shopify platform. We track Shopify's API versions and the security advisories for Shopify's app libraries, and apply updates promptly. Every app runs on a current Admin API version.
• Security reviews. We review every route, data path and database query of every app at regular intervals, most recently in October 2026, and run an automated audit before any change that touches authentication, sessions or data exposure.
• Monitoring. Availability is monitored around the clock and published on our status page, and errors alert us. Operational logs are kept for a limited time and never contain tokens, secrets or customer data.

Retention and deletion

• Processing history (events, runs, sent emails, submissions) is kept for a limited time, 30 days in most apps, longer only where a plan says so. The exact schedule is in each app's privacy policy.
• Shopify's mandatory privacy requests (customers/data_request, customers/redact and shop/redact) are handled automatically within the timelines Shopify sets. The shop/redact request that follows 48 hours after an uninstall erases the data we hold for your store.
• A signed data processing agreement (DPA, in English or German) can be requested on each app's website.

Per-app documents

App	Privacy policy	DPA	Help center
Workflow Trigger Extensions	Privacy	DPA	Docs, incl. its own security page
Workflow Webhooks	Privacy	DPA	Docs
Workflow Transactional Email	Privacy	DPA	Docs
Workflow Functions	Privacy	DPA	Docs
Workflow Suite	Privacy	DPA	Docs
Workflow Forms	Privacy	DPA	Docs
Workflow Documents	Privacy	DPA	Docs

Reporting a security issue

If you believe you have found a vulnerability in one of our apps, or you need a security questionnaire completed, email support@codecreationlabs.com. Security reports are read and answered with priority.