Security Policy

1. Information Security Principles

Nextmerce’s security architecture is built on the following foundational principles:

• Defense in Depth: Multiple layers of security are applied throughout our software, databases, and hosting infrastructure.
• Least Privilege Access: Access to systems, APIs, and databases is restricted to the minimum permissions necessary to perform the requested function.
• Tenant Isolation: Strong logical separation ensures that no organization can access or modify another organization’s data.
• Auditability: Critical events, authentication requests, and data sync flows are logged for security auditing.

2. API Authorization & Integration Security

Nextmerce connects to third-party ecommerce platforms (Shopify) and advertising networks (Meta Ads, TikTok Ads, Google Analytics 4) using secure API protocols:

3. Cryptographic Token Storage & Encryption

Access and refresh tokens granted by third-party platforms are treated as high-severity secrets:

• Application-Level Encryption: Plaintext tokens are never stored in the database. Nextmerce encrypts all access and refresh tokens at the application layer using AES-256 encryption before writing them to the database.
• Key Isolation: Encryption keys are stored securely in environment variables managed by Vercel and are not accessible within the codebase or database layers.
• Token Decryption: Decryption occurs transiently in server memory during background synchronization runs and is immediately garbage-collected.

4. Multi-Tenant Isolation (Row-Level Security)

Nextmerce runs a multi-tenant SaaS architecture backed by Supabase (PostgreSQL). We prevent cross-organization data access through strict database rules:

• Row-Level Security (RLS): RLS is enabled on all tables containing tenant data, including `orders`, `order_items`, `products`, `ad_accounts`, `ad_campaigns`, `ad_insights`, and `daily_traffic_insights`.
• Organization Boundary Mapping: Every row in these tables is tagged with an `organization_id`. Database queries are automatically gated to match the user’s active membership ID derived from the authenticated Supabase session.
• Headless Provisioning Security: Headless accounts created during automated Shopify OAuth installations (e.g., headless-[shop]@shopify.internal) are bound to their respective organizations under strict RLS policies to prevent any cross-tenant leakage.

5. Infrastructure & Deployment Security

Our hosting and deployment pipelines adhere to modern security best practices:

• Deployment Platform: Nextmerce is deployed on Vercel, leveraging serverless edge and Node.js functions. Vercel’s infrastructure includes automatic DDoS protection, firewalls, and SSL termination.
• Database Hosting: Nextmerce utilizes Supabase’s secure cloud infrastructure. The database is hosted in an isolated virtual private cloud (VPC) with database backups encrypted at rest.
• Transport Layer Security (TLS): All connections to Nextmerce are secured using TLS 1.2 or TLS 1.3. Plain text HTTP traffic is automatically redirected to HTTPS.
• Content Security Policy (CSP): Nextmerce configures HTTP response headers, including Content Security Policy, X-Frame-Options, and X-Content-Type-Options, to protect merchants against Cross-Site Scripting (XSS) and clickjacking.

6. Vulnerability Management & Incident Response

We actively monitor and address potential security risks:

• Dependency Auditing: Automated scanners review our Node.js dependency trees daily for known vulnerabilities (CVEs) and prompt immediate updates to resolve patches.
• Incident Response Plan: In the event of a suspected security breach, our incident response plan is activated:
  1. Containment: Revoke affected API tokens and isolate compromised infrastructure.
  2. Investigation: Conduct audit log reviews to identify the scope of the exposure.
  3. Notification: Notify affected merchants and regulatory bodies in accordance with applicable laws (typically within 72 hours of verification).
  4. Remediation: Apply permanent patches, cycle database keys, and publish post-incident reports.

7. Merchant Security Responsibilities

Security is a shared responsibility. Merchants using Nextmerce are expected to:

• Protect Account Credentials: Secure their Supabase authentication passwords and employ multi-factor authentication (MFA) where available.
• Revoke Unused Access: Disconnect integrations and delete inactive developer accounts if they are no longer in use.
• Limit Store Access: Grant the minimum administrative permissions necessary to team members accessing the Nextmerce dashboard.

8. Vulnerability Disclosure & Contact

We welcome security researchers and merchants reporting vulnerabilities. If you discover a security issue, please contact us privately:

• Email: security@nextmerce.app (cc: founder@nextmerce.app)
• Response SLA: We will acknowledge your report within 48 hours and provide weekly updates on progress until a resolution is deployed.
• Responsible Disclosure: We ask that you do not disclose the vulnerability publicly until we have had a reasonable opportunity to investigate and resolve it.