Security
Last updated 9 October 2026
Our apps watch for orders that silently fail to reach another system. To do that they need access to your store and to one other account: Starshipit for Missing Orders, Klaviyo for Sync Watch. This page says exactly what that access is, what we do with it, and how we protect it.
In short
- The apps only read. They never create, change or delete anything in Shopify, Starshipit or Klaviyo.
- No customer data is stored. We keep order numbers, statuses and times, never names, emails, phones or addresses.
- Keys and tokens are encrypted before they're stored, and never written to logs.
- They're deleted when you leave: on disconnecting, and on uninstalling.
What each app can reach
| Missing Orders | Sync Watch | |
|---|---|---|
| In Shopify | Read orders, fulfillment orders and locations. No customer fields are requested. | Read orders. No customer fields are requested. |
| In the other system | Your Starshipit API keys, which you paste in. Used only to ask whether an order is there. | Klaviyo access you approve on Klaviyo's own screen, limited to reading your account, events and metrics. |
| What we ask for | Whether each order exists in Starshipit, and its status. | Only the order id on each "Placed Order" event, so Klaviyo never sends us profiles or email addresses. |
Starshipit keys can do more than we use
Starshipit's API keys aren't limited to reading. Whoever holds them could also create or change orders, and a lookup can return your customers' details. So we treat them as the most sensitive thing we hold:
- Missing Orders' Starshipit connection is built to make read requests only. There is no code in it that writes to Starshipit.
- When Starshipit's reply includes customer details, the app reads whether the order is there and its status, and discards the rest without storing or logging it.
- The keys are encrypted at rest and decrypted only in memory, for the length of a check (below).
- You can remove them at any time: disconnect in the app, or regenerate the keys in Starshipit, which cuts our access at once.
Klaviyo works differently: you connect through Klaviyo's own consent screen, which grants read-only access, and you can remove it from either side.
How keys and tokens are protected
- Encrypted before storage with AES-256-GCM, which also detects tampering. The encryption key is held separately from the database, so a copy of the database alone can't reveal them.
- Never logged. Neither are raw Shopify, Starshipit or Klaviyo responses. Our request logs record the method, path, status and timing, never the query string, which is where Shopify puts its session details.
- Encrypted in transit. The apps talk to Shopify, Starshipit, Klaviyo and our email provider only over TLS.
- A private database. It runs on Railway's private network, reachable only by the app itself.
When it's deleted
- Disconnect: the keys or tokens are deleted straight away. For Klaviyo, we also tell Klaviyo to cancel our access.
- Uninstall: checks stop and the keys or tokens are deleted straight away. Everything else we hold for your store is deleted when Shopify asks, 48 hours later, or by us a week after uninstalling if Shopify never asks.
The full list of what each app stores, why, and who processes it is in our privacy policy.
Reporting a problem
If you think you've found a security issue in our apps or this site, please email support@quietpenguin.com. We'll reply within two working days and keep you posted until it's fixed.