Baarre · Legal & policies

Security

How we protect your store’s data, and how to report a problem.

Protecting data

• In transit — TLS 1.2 or higher on every connection.
• At rest — AES-256 encryption on databases and backups.
• Passwords — hashed with bcrypt. Nobody at Baarre can read yours.
• Isolation — each store’s data is separated; one merchant can never read another’s.
• Backups — daily, encrypted, retained 30 days, restore-tested quarterly.

Access control

• Role-based permissions across 24 permissions in your own account.
• Internal access is least-privilege, logged, and requires two-factor authentication.
• Production access is limited to on-call engineers and reviewed quarterly.

Shopify permissions

We request the minimum scopes needed: read products, collections, pages, policies, orders and customers. Baarre never requests write access to your catalogue or the ability to change orders.

Reporting a vulnerability

Email security@baarre.com with steps to reproduce. We acknowledge within one hour during business hours, keep you updated, and pay a bounty for valid reports. Please do not test against other merchants’ stores or run denial-of-service tests.

Incidents

We notify affected merchants without undue delay, and within 72 hours where the law requires it, with what happened, what data was involved and what we did.