Security at Downpay

Is my customers' card data safe?

Customers placing orders using Downpay still pay in Shopify's PCI compliant checkout. Shopify processes the payment and holds the payment method. Downpay sees only the references Shopify provides back so that our app can ask Shopify to charge the remaining balance.

Can Downpay change what my shoppers see, or where they check out?

Only to show its deposit options. Downpay adds them to your product and cart pages. It doesn't load scripts from anywhere else, and it always sends shoppers to Shopify's own checkout.

Downpay's storefront code is a Shopify theme app extension. It is built from our source code by our deployment pipeline and served by Shopify's own CDN.

Here is what Downpay does not do:

• Downpay's storefront code does not load other scripts, and the only network requests it makes go to your own store's Shopify cart and Storefront API.
• Downpay has no checkout address of its own. When our storefront code sends a shopper to checkout, it uses the checkout address Shopify returns for that cart.
• Downpay does not request permission to edit your theme. Its access to your theme is read-only, and is used to check whether your theme supports app blocks.

What data do you keep?

We keep only what Downpay needs to work with your orders:

• Order records from Shopify: order identifiers, order totals and currency, payment status, the payment gateway used, and the payment references and error codes Shopify returns.
• Your shop's contact email, and the name and email of the staff users who sign in to Downpay.
• No card numbers. Payment methods are held by Shopify.
• No customer names, addresses or email addresses in our database. When we need to send a buyer a notification, we retrieve their email from Shopify at that time.

How do you protect it?

• Downpay is hosted on AWS in the United States. Our servers run in data centres with their own physical security, monitoring and redundancy.
• Traffic between merchants or shoppers and the Downpay app is encrypted in transit over public networks (HTTPS), and HTTP requests are redirected to HTTPS. Order details and sign-ins can't be read or altered by anyone on the network in between, such as on public Wi-Fi.
• Data is encrypted at rest. A copied disk or backup can't be read without our encryption keys.
• Downpay meets the requirements of Shopify's protected customer data program (Level 2). Shopify sets these rules for apps that handle customer data: limit access to what the app needs, and protect it in storage and in transit.
• We request only the Shopify permissions Downpay's features need. This limits what anyone could do with our access to your store.
• Every Downpay staff account requires two-factor authentication. A stolen or guessed password alone can't get anyone into our systems.
• Only our automated pipeline can publish a new version of the app. No one can quietly change the scripts that run on your storefront.
• We maintain written security policies. Access, changes and incident response follow a documented process every time.
• We take automated backups. Your order records can be restored if something goes wrong.
• We use automated dependency updates and alerts. Known vulnerabilities in the open-source libraries we use are flagged to us and fixed.

Our Security Measures document is on our legal page.

What can I share with my security or compliance team?

Card payments for Downpay orders run through Shopify checkout, which is certified PCI DSS Level 1. Downpay never handles card numbers, so that certification covers the payment step. For the rest of Downpay, our Security Measures, Data Processing Addendum and Sub-processor List are on our legal page, and we complete security questionnaires on request at support@hypehound.io. Downpay doesn't hold a separate certification such as SOC 2.

How do I report a security issue?

Email security@hypehound.io. If something looks wrong on your storefront or checkout, include screenshots and your store's myshopify.com address. We review every report and respond when appropriate. We don't offer a reward.

In scope: the Downpay app and its APIs. Out of scope: automated scanner output about our marketing site.