Security practices for merchant and shopper data.
How we protect Shopify permissions, customer data, and review media.
Last updated: August 11, 2026. Legal entity: Ravanix Technologies L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.. Privacy: privacy@ravanix.app. Support: admin@ravanix.app. Security: security@ravanix.app. Website: https://reviews.ravanix.app.
Encrypted transport
Production traffic runs over HTTPS for the website, embedded app, APIs, widgets, review request flows, uploads, exports, and Shopify webhooks.
Scoped Shopify access
The app requests only the Shopify scopes needed for product sync, review workflows, order-based requests, customer verification, discounts, themes, and metaobjects.
Sensitive data protection
Customer and order PII is protected with encrypted transport, restricted access, and encryption-at-rest controls for protected fields and backups.
Least-privilege operations
Support and engineering access is role-limited, reviewed, logged, and removed when no longer needed.
Environment separation
Production, test, and local development data stay separate, and production secrets are never committed to the repository.
Incident readiness
Security issues are triaged, contained, documented, communicated, remediated, and followed by prevention work.
Report a security concern.
Share reproduction steps, affected domains, timestamps, and impact through security@ravanix.app or the contact page. Please avoid accessing, changing, or deleting merchant, shopper, order, review, or media data while investigating.
Contact security