Security and data protection
What we protect, and how
Invoices carry customers' names, addresses, phone numbers and GSTINs. This page says in plain terms how Orbit Connect protects that data, what you control, and where the limits are.
Signing in and access
The Orbit Connect app runs inside your Shopify admin and signs you in with Shopify's own OAuth and session tokens. There is no separate password for the app. Access is authenticated and scoped to your store: the app looks records up by your store's address, taken from the verified Shopify session.
Customers who download an invoice from their Shopify customer account are authenticated with Shopify's customer-account session token before a download link is issued.
Encryption
The app encrypts sensitive fields with AES-256-GCM before they are written to the database. Each value gets its own random nonce and is bound to your store and the field it belongs to. The encryption key is held in the server's environment, apart from the database.
These are encrypted:
- on documents: customer name, email, phone, GSTIN, billing and shipping address, city, PIN code, country, order references and notes;
- delivery records: the recipient and any error message;
- saved customer GST profiles: company name and GSTIN;
- queued webhook and job payloads (they are also cleared once processed);
- e-invoice requests and responses;
- credentials you save for integrations: SMTP password, WhatsApp access token, GSP login, Odoo API key and Zoho tokens.
Email addresses and phone numbers are also stored as keyed hashes so records can be found without decrypting them. API keys are stored only as hashes.
What is not field-encrypted: invoice amounts and line items, your own business profile (legal name, GSTIN, address, and any bank details you choose to print on invoices), and Shopify's session records. Connections use HTTPS. We do not describe the server's disk or database file as encrypted.
Download links
Invoice download links carry a random 256-bit token. Only a hash of the token is stored, the link expires, can be limited in how often it is used, and can be revoked. Links for customers' account pages are short-lived; the link you can add to an order-confirmation email lasts longer.
Audit trail
The app records actions per store: report exports, document downloads, views of protected order data, consent and opt-out changes, integration connections and disconnections, e-invoice submissions, numbering resets and acceptance of the data terms. Audit records are deleted after 365 days.
What the app asks Shopify for
These are the access scopes the app requests, and what each is used for. The list is checked against the app's configuration whenever this site is tested.
| Scope | Used for |
|---|---|
read_orders | Read the orders you invoice: items, amounts, taxes, refunds and payment status. |
read_customers | Read customer names, contact details and addresses so they can appear on invoices, and to manage saved customer GST details. |
read_fulfillments | Read shipments so an invoice can be issued per shipment and delivery documents can be produced. |
read_locations | List your Shopify locations so each one can be linked to a GST registration. |
write_orders | Save a signed invoice download link on the order, so you can use it in your order-confirmation email. |
write_products | Save the GST rate, HSN/SAC code and related tax fields on products, including bulk import. |
write_draft_orders | Listed in the app's configuration. No current feature creates or edits draft orders. |
The app also listens for these Shopify webhooks:
orders/paid: Create the invoice for a paid order when automatic invoicing is on.fulfillments/create: Create a per-shipment invoice when that setting is on.app/uninstalled: Remove the store's access tokens when the app is uninstalled.app/scopes_update: Keep the stored list of granted permissions current.customers/data_request, customers/redact, shop/redact: Shopify's mandatory privacy requests: data requests, customer erasure and shop erasure.
Shopify privacy requests
Shopify's three mandatory privacy webhooks are handled: customer data requests, customer erasure and shop erasure. A customer erasure request removes the customer's name, contact details, GSTIN, billing address and order references from matching documents and revokes their download links. On shop erasure the store's documents, settings, GST registrations, consent records, saved integration credentials, sessions and audit trail are deleted. When the app is uninstalled, its Shopify access tokens are removed.
Retention and deletion
You set how long documents are kept. Other records have fixed periods:
| Data | Kept for |
|---|---|
| Invoices, credit notes and other documents | For the retention period you set in the app: 2,555 days (seven years) by default, adjustable from 30 to 2,920 days. When it ends, the customer's name, contact details, GSTIN, billing address and the order references on the document are removed. |
| Delivery records and download-link records for those documents | Removed when the document is redacted. Download-link records are also removed 30 days after the link expires. |
| Webhook and background-job records | Their payloads are cleared once processed, and the records are deleted after 30 days. |
| Privacy-request records | Deleted 30 days after the request is completed. |
| Audit events | Deleted after 365 days. |
| Delivery consent and opt-out records | Deleted 2,555 days (seven years) after their last update. |
| Shopify access tokens and sessions | Deleted when the app is uninstalled. |
| Documents, settings, GST registrations, saved integration credentials and the audit trail for a store | Deleted when Shopify sends its shop-erasure request after uninstall. |
Tax rules may require you to keep invoices for a set period. Choose a retention period that suits your own obligations, and check it with your accountant.
What you control
- Whether to accept the data-processing terms in the app. Customer data is not opened until you do.
- How long documents are kept, and when the retention clean-up runs.
- Which delivery channels are on. WhatsApp needs a recorded consent for each customer, and a recorded opt-out stops delivery on both channels.
- Which integrations are connected. Disconnecting email (SMTP), WhatsApp or Odoo removes its saved credentials.
- Which API keys exist. A key can be revoked at any time.
In the app's data-processing terms, you are the controller of your customers' data and Orbit Connect processes it on your instructions. We do not sell personal data, use it for advertising, or use it for automated decisions with legal or similarly significant effects.
This website
This site, toolsmania.in, is separate from the app. If you create an account here:
- passwords are stored only as Argon2id hashes;
- sessions use a random token that is stored only as a hash, with idle and absolute time limits, and every session can be ended from your account;
- forms are protected against cross-site requests, and sign-in, sign-up, password-reset and contact attempts are rate limited;
- the site sends security headers, including a strict content security policy, and loads no third-party scripts, fonts or analytics.
The privacy policy lists exactly what the site collects and the cookie notice lists the cookies.
Limits
- Orbit Connect has not yet been through an independent security certification or audit.
- Field encryption protects the fields listed above. It does not replace good practice on your side: use strong passwords and two-step verification on your Shopify, email and accounting accounts.
- Integrations you connect, such as your email provider, WhatsApp account, GSP, Zoho or Odoo, are run by those providers and are covered by their terms.
- If we find that your data has been affected by a security incident, we will tell you.
Report a vulnerability
If you believe you have found a security problem in Orbit Connect or this website, please tell us privately first, using the contact form with the topic "Security report". Our contact details are also published at /.well-known/security.txt.
- Give us a reasonable time to fix the issue before you share it.
- Do not access, change or delete data that is not yours, and do not disrupt the service.
- Tell us what you found, where, and how to reproduce it.
We do not currently run a paid bug-bounty programme.