Security policy

Last updated September 30, 2026

This policy describes how Mint Labs protects the data Mint Downloads handles — merchants' files and license keys, and personal data of merchants' customers processed on behalf of merchants. It applies to everyone at Mint Labs with access to our systems.

Data loss prevention

• We keep as little personal data as possible: no customer names, email addresses, phone numbers or postal addresses are stored. A buyer's email address is used in memory to send the download email and never written to our database or logs.
• Files are stored in a private Cloudflare R2 bucket with no public URL. A file can only be downloaded through a link signed with a server-side secret for one file of one paid order; links expire, can be limited in number of downloads and can be replaced by the merchant at any time.
• Downloads are served with headers that force a download and stop browsers from running file contents on our domain (attachment disposition, no-sniff, sandboxed content security policy).
• The Thank you and Order status blocks only receive an order's downloads with a session token signed by Shopify and the order's confirmation number; failed checks get the same answer as orders without downloads and are rate-limited.
• Our database is Cloudflare D1 and our file store Cloudflare R2, both encrypted at rest; D1 has point-in-time recovery.
• All traffic uses HTTPS (TLS). Production and development use separate databases and storage; development never uses real merchant or customer data.
• Webhooks are verified with Shopify HMAC signatures; unsigned requests are rejected.

Access control

• Only authorised Mint Labs personnel who need it to run and support the app can access production systems.
• The app has no internal screen that lets us browse orders, customers' data or merchants' files.
• Access is removed immediately when it is no longer needed.

Passwords and authentication

• Every account with access to production (hosting and Shopify Partner) uses a strong, unique password stored in a password manager.
• Two-factor authentication is required on all of those accounts.
• API secrets and the download-link signing secret are stored as encrypted environment secrets, never in source code, and are rotated after any suspected exposure.

Logging

• Every request to the app, including requests that process personal data, is logged with a timestamp by our hosting provider's request logs. Our own log lines never contain customers' names, email addresses, addresses or file contents.
• Logs are reviewed when investigating errors or suspected incidents.

Security incident response

1. Report. Anyone can report a suspected issue to support@stickermint.com. We acknowledge reports within one business day.
2. Contain. We stop the exposure first: disable the affected feature, rotate the link-signing secret (which invalidates every download link at once), revoke and rotate keys and access tokens, and block abusive traffic.
3. Investigate. We use request logs and database history to find what happened, which shops and data were affected, and when.
4. Notify. If personal data was affected, we notify affected merchants without undue delay and within 72 hours of confirming the incident, and tell Shopify where required, with what happened and what we are doing about it.
5. Recover. We fix the root cause and, if needed, restore data from point-in-time recovery.
6. Review. We record each incident and the lessons learned, and update this policy.

Contact

Mint Labs — support@stickermint.com