Security and data handling

Three commitments about how it works underneath

Numbers stay right

Shopify resends the same order webhook more than once: that is normal, and it is how naive integrations end up double-counting a debt. Quay recognises a repeat and ignores it, and available credit is recalculated from the full list of outstanding orders rather than nudged up and down. So the same order arriving twice cannot move a number, and a missed message cannot leave one permanently wrong.

One store cannot see another

Every database query in Quay is scoped to a single store, and that is not a convention someone has to remember. The database layer refuses to run a query that has not been scoped, so the failure mode is an error in our logs, not your data on someone else's screen.

We make money one way

The subscription. No cut of your receivables, no markup on payment processing, no selling data to anyone. Quay never touches the money itself (Shopify processes every order exactly as it does today), so there is no second revenue stream whose interests could quietly diverge from yours.

What Quay reads and what it keeps

Quay asks Shopify for what it needs to compute credit and nothing beyond it: your companies and their locations, your orders and refunds, and the payment terms attached to them. It keeps working copies of the order totals and due dates so the AR dashboard does not have to re-query Shopify on every page load, plus its own records: your credit limits, your policies, an audit log of who changed what, the events where an order got past a block, a record of each set of suggestions you applied, so you can undo it, and a record of each privacy request about your buyers that Shopify sends Quay.

It never sees a buyer's card or bank details. It stores the payment details you choose to print on statements (your bank, account name and number, SWIFT/BIC, IBAN, routing or sort code, branch, and a payment note), and, if you add them, a phone number and an email address per company for the statement's address block. It holds no buyer names: the buyer-facing page is built from the company record Shopify already has, and it identifies people through Shopify's own customer accounts rather than keeping its own copy. A statement reads the company's address from Shopify when it is rendered and does not store it. Beyond those, the personal data Quay does keep is mostly on your side of the desk: the staff name shown against an entry in the audit log, and your own session. The exception is a buyer whose privacy request Shopify sends Quay: Quay keeps Shopify's ID numbers for that buyer and for the orders the request names, and a code made from their email address that can't be turned back into it, never the address itself. What you write to us in the support chat is kept by Crisp, the chat service, not in Quay's database.

The full field-by-field list is in the Privacy Policy, which together with the Terms of Service is also the written processing agreement required under GDPR Article 28.

What your buyers can see

If you switch on the buyer-facing page, a signed-in contact at a company sees company-level totals: next due date, amount due, total outstanding, and (only if you leave those figures on) the company's credit limit and how much of it is left. If you also switch on Show statements to buyers, the page lists that company's own orders that still carry a balance, the same ones its statement carries. What it never shows is another contact's orders, and it never exposes one company to another. Buyers sign in through Shopify's own customer accounts; Quay does not run a login of its own.

When something breaks, checkout stays open

Quay is deliberately fail-open. If its checkout check errors or its data is missing, the order goes through rather than being blocked. Stopping a legitimate buyer because of a bug on our side is a worse outcome than letting one over-limit order past, and that is a decision we made on purpose rather than a gap we are describing kindly.

You still find out: every order is re-checked right after it is placed, so anything that slipped through shows up in your alerts if you have connected a Telegram chat.

Uninstalling

Uninstall and your access tokens and sessions are deleted immediately. Quay can no longer reach your store at all. The rest of your Quay data is scheduled for deletion 30 days later, so that a reinstall inside that window keeps your policies and history. After the grace period everything goes: audit log, order records, policies, caches. Choose Shopify's "delete app data" option on uninstall and it is wiped immediately instead, unless you reinstall Quay first. Either way, one list stays: for each buyer of yours who asked to be erased, a code made from their email address, never the address, so Quay never emails them for your store.

Where it runs

The app runs on DigitalOcean's App Platform, with its database reachable only over a private network rather than the public internet, and HTTPS end to end. This website is a separate thing on separate infrastructure. That is deliberate: editing a marketing page can never touch the app your store depends on.

Subprocessors are listed in the Privacy Policy. Today that is DigitalOcean, Cloudflare, Crisp for the support chat inside the app, and Telegram if you connect a chat for alerts. Shopify isn't on that list: it's your own platform, and you have your own agreement with it.

Reporting something

If you find a security problem, write to security@quayhq.com. Machine-readable details are at /.well-known/security.txt. You will get a human reply, not a ticket number.