---
title: Trust Centre: Security for Shopify Merchants
description: What Tacey holds about your store and your customers' addresses, where it's processed, and how you get it back. Subprocessors, in one place.
canonical: https://tacey.app/trust
---
# Trust Centre: Security for Shopify Merchants

Tacey sits between a store and its customers' addresses, which means it handles personal data. This page states exactly how much, for how long, and who else touches it.

Badges: SOC 2 Type II infrastructure (Cloudflare), ISO 27001 infrastructure (Cloudflare), GDPR and CCPA ready, card data never reaches Tacey, every subprocessor listed below. The first two describe the infrastructure Tacey runs on, held by Cloudflare, not certifications Tacey holds itself.

## Least-privilege access

- **What we read**: orders and their shipping addresses, so they can be checked; the shop's settings and plan, so Tacey knows how to behave.
- **What we write**: a validation result on the order; address and line-item changes, only ones explicitly confirmed by the merchant or customer.
- **What we never touch**: payment details. Tacey never sees or stores a card. Money only moves through Shopify's own flow, with a confirmation, every time.

## Where data lives, and how long

- Encrypted in transit: every connection uses TLS.
- Encrypted at rest: by the infrastructure provider's default.
- Held on Cloudflare: the application, database, and stored payloads all run on Cloudflare's network.
- Deleted when a merchant leaves: Shopify tells Tacey to erase the data on uninstall, including archived raw order payloads.

## Customer privacy requests are handled automatically

Shopify sends three mandatory privacy webhooks, all wired and answered: a customer asking what data is held, a customer asking to be erased, and a store asking to be erased after uninstall.

## Subprocessors

| Subprocessor | What they do | What they receive |
|---|---|---|
| Cloudflare | Hosting, database, storage, queues | All application data |
| Google | Address validation and geocoding | The shipping address being checked |
| Geocodio | US and Canada address validation | The shipping address being checked |
| Cloudflare Email Sending | Sending customer emails | Customer email address and order details |
| Mixpanel | Product analytics | Usage events. No customer addresses |
| PostHog | Product analytics | Usage events. No customer addresses |

See /subprocessors for the full detail.

## What happens when something breaks

- Address checking never blocks a sale: if the checker is slow or a provider has a bad minute, the order goes through exactly as it would have, marked unchecked rather than guessed.
- Money never moves on its own: not on an upward edit, not on a refund, not by default, and not on the day of install.
- Every edit leaves a record: what changed, what it cost, who asked, and whether the warehouse acknowledged it.

## Documents

- Privacy Policy: /privacy
- Terms of Service: /terms
- Data Processing Agreement: /dpa