Technical and Organisational Measures, Stackable
Version: 1.0
Effective date: 23 September 2026
Optizio Ltd maintains the following Technical and Organisational Measures (“TOMs”) for the Stackable: Combined Discounts Shopify application. These measures are intended to support the confidentiality, integrity, availability, and resilience requirements in Article 32 of the EU GDPR and UK GDPR.
1. Confidentiality
1.1 Physical and Infrastructure Security
- Stackable uses Cloudflare-managed infrastructure. Optizio personnel do not have physical access to the data-centre infrastructure.
- Cloudflare provides physical security controls for its facilities, including controlled access and monitoring.
1.2 Logical Access Control
- Administrative access to critical systems requires multi-factor authentication.
- Access is granted according to role and least-privilege principles, reviewed quarterly, and revoked promptly when no longer required.
- Production credentials are restricted to authorised personnel.
1.3 Credentials and Secrets
- The Shopify application client secret and other sensitive deployment credentials are stored as deployment secrets, rather than in source control.
- Shopify access tokens are stored in Cloudflare KV-backed session storage and used only to perform authorised operations for the relevant Shopify store.
- Secrets are replaced following suspected compromise or a required access change.
1.4 Data Minimisation
- Stackable stores merchant, staff, billing, subscription, and support data only as necessary to provide, administer, and secure the Service.
- Discount configuration remains in the Controller’s Shopify account.
- Stackable does not request the Shopify
read_customers scope or store customer profiles.
- The upsell-attribution webhook handler extracts only product/variant identifiers, quantity, price, and currency. It does not intentionally persist or onward-transfer other fields that may be included in Shopify’s standard webhook delivery.
2. Integrity
2.1 Encryption in Transit and at Rest
- Data transmitted between users, Stackable, Shopify, and service providers is protected using TLS.
- Data held in Cloudflare-managed storage is encrypted at rest by the platform.
2.2 Change Management and Secure Development
- Stackable changes are developed and deployed through controlled source-control and deployment processes.
- Continuous integration runs linting, unit tests, production builds, static analysis, and dependency auditing.
- Third-party GitHub Actions used by the deployment pipeline are pinned to commit hashes and monitored for updates.
2.3 Logging and Monitoring
- Security and application events are monitored.
- Application errors are captured through Sentry to support diagnosis and remediation.
- Access to production operational endpoints is restricted to authorised personnel.
3. Availability and Resilience
- Stackable uses Cloudflare-managed Workers, KV, and D1 services.
- Stackable discount functions execute within Shopify’s platform and do not call Optizio systems during checkout discount calculation.
3.2 Backup and Recovery
- Cloudflare D1 data supports point-in-time recovery within the preceding 30 days where applicable.
- Backup and recovery practices are governed by the Optizio Backup Policy.
- Recoverability is tested periodically.
3.3 Incident Management
- Optizio maintains an Incident Response Plan covering detection, containment, eradication, recovery, and communications.
- Optizio will notify affected controllers without undue delay after becoming aware of a Personal Data Breach affecting their Personal Data.
4. Assessment and Review
- Optizio reviews its Information Security Policy, SDLC Policy, Incident Response Plan, and Backup Policy at least annually or after a significant change.
- Penetration testing is performed for major releases or significant architectural changes.
- Personnel receive regular information-security, data-protection, and incident-reporting training.
Version History
| Version |
Date |
Changes |
| 1.0 |
23 September 2026 |
Initial Stackable-specific TOMs. |