Security and data handling

Three commitments about how it works underneath

Numbers stay right

Shopify resends the same order webhook more than once — that is normal, and it is how naive integrations end up double-counting a debt. Quay recognises a repeat and ignores it, and available credit is recalculated from the full list of outstanding orders rather than nudged up and down. So the same order arriving twice cannot move a number, and a missed message cannot leave one permanently wrong.

One store cannot see another

Every database query in Quay is scoped to a single store, and that is not a convention someone has to remember. The database layer refuses to run a query that has not been scoped, so the failure mode is an error in our logs, not your data on someone else's screen.

We make money one way

The subscription. No cut of your receivables, no markup on payment processing, no selling data to anyone. Quay never touches the money itself — Shopify processes every order exactly as it does today — so there is no second revenue stream whose interests could quietly diverge from yours.

What Quay reads and what it keeps

Quay asks Shopify for what it needs to compute credit and nothing beyond it: your companies and their locations, your orders and refunds, and the payment terms attached to them. It keeps working copies of the order totals and due dates so the AR dashboard does not have to re-query Shopify on every page load, plus its own records: your credit limits, your policies, an audit log of who changed what, and the events where an order got past a block.

It never sees payment card details, bank details or payment credentials, so it cannot store them. It holds no buyer names or email addresses either: the buyer-facing page is built from the company record Shopify already has, and it identifies people through Shopify's own customer accounts rather than keeping its own copy. The personal data Quay does keep is on your side of the desk — the staff name shown against an entry in the audit log, and your own session.

The full field-by-field list is in the Privacy Policy, which together with the Terms of Service is also the written processing agreement required under GDPR Article 28.

What your buyers can see

If you switch on the buyer-facing page, a signed-in contact at a company sees company-level totals: next due date, amount due, total outstanding, and — only if you leave those figures on — the company's credit limit and how much of it is left. It never lists individual invoices, never shows another contact's orders, and never exposes one company to another. Buyers sign in through Shopify's own customer accounts; Quay does not run a login of its own.

When something breaks, checkout stays open

Quay is deliberately fail-open. If its checkout check errors or its data is missing, the order goes through rather than being blocked. Stopping a legitimate buyer because of a bug on our side is a worse outcome than letting one over-limit order past, and that is a decision we made on purpose rather than a gap we are describing kindly.

You still find out: every order is re-checked right after it is placed, so anything that slipped through shows up in your alerts if you have connected a Telegram chat.

Uninstalling

Uninstall and your access tokens and sessions are deleted immediately — Quay can no longer reach your store at all. The rest of your Quay data is scheduled for deletion 30 days later, so that a reinstall inside that window keeps your policies and history. After the grace period everything goes: audit log, order records, policies, caches. Choose Shopify's "delete app data" option on uninstall and it is wiped immediately instead.

Where it runs

The app runs on DigitalOcean's App Platform, with its database reachable only over a private network rather than the public internet, and HTTPS end to end. This website is a separate thing on separate infrastructure — deliberately, so that editing a marketing page can never touch the app your store depends on.

Subprocessors are listed in the Privacy Policy. Today that is Shopify, DigitalOcean, Cloudflare, and Telegram if you connect a chat for alerts.

Reporting something

If you find a security problem, write to [email protected]. Machine-readable details are at /.well-known/security.txt. You will get a human reply, not a ticket number.