---
title: "Security - Workflow Suite"
description: "What Workflow Suite is built on, where it runs, how your run data, secrets and credentials are encrypted and isolated, and how we keep the app up to date. No PHP anywhere."
canonical: "https://docs.workflow-suite.app/security"
---

# Security

Workflow Suite is built and operated by Code Creation Labs. This page explains what the app is made of, where it runs, how your store's data is protected and how we keep everything up to date. It is written for store owners and for anyone filling in a security questionnaire. What is stored, the sub-processors and the legal documents are on [Data, privacy and hosting](https://docs.workflow-suite.app/legal.md).

## What the app is built on

| Layer | What we use |
| --- | --- |
| Application code | TypeScript on Node.js, a current long-term-support release. The workflow editor, the engine that runs your workflows and the services around them are one code base. |
| Database and cache | PostgreSQL (Google Cloud SQL) and Redis (Google Cloud Memorystore) |
| Queue | Runs are queued in Google Cloud Pub/Sub and picked up by workers, so a burst of events or a slow answer from an external system never loses a run. |
| Hosting | Containers on Google Kubernetes Engine in Google Cloud region europe-west1 (Belgium, European Union). Databases, caches, queues and file storage are region-local. |
| Shopify integration | Shopify's official app libraries, the Admin GraphQL API and Shopify's webhooks |
| Your storefront | Nothing runs in your theme. The optional web pixel behind the [Storefront behaviour triggers](https://docs.workflow-suite.app/storefront-behaviour-triggers.md) runs inside Shopify's pixel sandbox, receives events only from visitors who gave analytics consent, and is installed only when you turn such a trigger on. |

There is no PHP, WordPress, Java or other runtime anywhere in the service. The app is listed on the Shopify App Store and passed Shopify's app review, which covers Shopify's security and protected customer data requirements.

> [!NOTE]
> **When a vulnerability is in the news**
> If an advisory concerns PHP, WordPress, Java, .NET or another technology the app does not use, it cannot affect Workflow Suite and there is nothing you need to do. If it concerns Node.js, PostgreSQL, Redis or one of the libraries we use, the process under "How we keep the app up to date" applies: the fix ships with the next release, and a critical issue gets a release of its own. You are always welcome to send the advisory to support@codecreationlabs.com and we will confirm in writing whether it applies.

## How your data is protected

**In transit.** Every connection between your browser, Shopify, the systems your workflows talk to and the app uses TLS. The database, the cache and the queue have no public address: they are reachable only from inside our private network.

**At rest.** All databases and storage are encrypted at rest with keys we manage in Google Cloud KMS.

**Field-level encryption on top.** The most sensitive values get a second layer: your store's Shopify access token, your secrets, the logins of your email senders and file connections, and each run's data (the event that started it and the results of its steps), which is sealed under a key dedicated to customer data. Change triggers keep the fields they watch encrypted the same way. Each value is encrypted individually with AES-256-GCM under a separate key in Cloud KMS, with automatic key rotation, and decrypted in memory only for the moment a step runs. Secret values are masked in step results and error messages, never written to logs, and never returned by the Developer API or over MCP.

**Secrets.** API credentials and keys of the service itself live in Google Secret Manager and are loaded when a service starts. They are not in the code, not in the container images and not in the build pipeline.

**Data minimisation.** The app asks for no data access on install. Every permission is granted per resource on the Permissions page through Shopify's own dialog and can be revoked at any time. See [Permissions and store data access](https://docs.workflow-suite.app/permissions-and-store-data-access.md). The email send log keeps the number of recipients, not their addresses.

## Who can access what

- **Your store only.** Every workflow, run, secret and file carries the store it belongs to, and every query is scoped to the store that was authenticated. One store can never read or run another store's workflows.
- **Verified requests only.** Pages inside the Shopify admin are authenticated with Shopify session tokens. Shopify's webhooks and Flow calls are verified by Shopify's HMAC signature, and internal messages by Google-signed identities, before any data is touched. Each [Incoming webhooks](https://docs.workflow-suite.app/incoming-webhooks.md) URL is unguessable and starts only the workflow it belongs to, and [Loop protection](https://docs.workflow-suite.app/loop-protection.md) stops a workflow from triggering itself without end.
- **Code steps.** JavaScript you write for [Run code and functions](https://docs.workflow-suite.app/run-code.md) runs in an isolated sandbox with a time and memory limit, on separate infrastructure from the app's own servers. It never sees the app's credentials or your Shopify access token; store data reaches it only through a short-lived token bound to that one run.
- **Outbound connections.** Every address a workflow connects to, for HTTP requests, chat messages, email, SFTP and FTP and file downloads, is checked before connecting: loopback, link-local, cloud metadata and private network addresses are refused, and the host is resolved once and pinned so that a redirect or a DNS change cannot lead somewhere else.
- **Our team.** Production systems are reached only through Google Cloud IAM with individual accounts. Internal maintenance tools are not exposed to the internet.

## How we keep the app up to date

- **Every change is scanned before it can ship.** The pipeline runs type checks and linting, static application security testing (SAST), secret detection, dependency vulnerability scanning and container image scanning. Our release bar is zero known vulnerabilities in dependencies and in the image.
- **Runtime and operating system.** The container image, Node.js on its Alpine Linux base, is rebuilt with every release, so runtime and operating system patches ship continuously. The managed Kubernetes platform keeps the underlying nodes patched.
- **Shopify platform.** We track Shopify's API versions and the security advisories for Shopify's app libraries, and apply updates promptly. The app runs on a current Admin API version.
- **Security reviews.** We conduct a full internal review of every route, data path and database query at regular intervals, most recently in October 2026.
- **Monitoring.** Availability is monitored around the clock and published on our [status page](https://crm.codecreationlabs.com/status/shopify-public-apps), and errors alert us. Operational logs are kept for at most 30 days and never contain tokens or secrets.

## Retention and deletion

- Run history is deleted automatically after the run history period of your plan, 30 to 180 days. See [Run history and troubleshooting](https://docs.workflow-suite.app/run-history-and-troubleshooting.md).
- Workflows, files, secrets, key-value entries and senders can be deleted by you at any time.
- When you uninstall the app, its access to your store is deleted immediately. Shopify's shop/redact request, which follows 48 hours after uninstall, erases the store's data.
- Shopify's mandatory privacy requests (customers/data_request, customers/redact and shop/redact) are handled automatically within the timelines Shopify sets.
- Sub-processors and the full retention schedule are in the [privacy policy](https://workflow-suite.app/privacy). A signed data processing agreement is available on request from support@codecreationlabs.com.

## Reporting a security issue

If you believe you have found a vulnerability, or you need a security questionnaire completed, email support@codecreationlabs.com. Security reports are read and answered with priority.