Security

Last updated: November 1, 2026

This page explains how The AI Co-Founder protects the data of the businesses we serve and of their visitors and customers. Questions or a security concern? Email mohsin@aicofounderhq.com.

Encryption

All traffic between browsers, Shopify, our servers and our storage uses HTTPS (TLS). Stored data is encrypted at rest with AES-256 by our storage provider. Backups are additionally encrypted by us with AES-256-GCM using a key held only in our server environment, separate from the backups themselves.

Backups and data loss prevention

  • An encrypted backup of production data is created every night and kept for 30 days, so data can be restored after an accidental deletion or failure.
  • We collect only what the service needs. Shopify order details are read only at the moment a shopper asks about their own order and are never stored.
  • Shopify access uses short lived tokens that expire after one hour and refresh automatically.
  • Personal data is never exported to third parties other than the service providers listed in our Privacy Policy.

Access control and logging

  • Administrative access is limited to the founder and protected by a long random secret key. Merchants see only their own data.
  • Every view of shopper data, whether by our administrator, by a merchant in the app, or through an owner review link, is recorded in an access log with the time and the record viewed. Access logs are kept for 180 days.
  • Owner review links are signed and work only for the email they were created for.

Separation of test and production data

Data from Shopify development and test stores is labeled as test data, excluded from backups, and deleted automatically 7 days after the test store uninstalls the app.

Retention and deletion

Leads and conversations are kept while an account is active. Data for closed accounts is deleted automatically 90 days after closing. When Shopify sends a customer or shop redaction request, the matching data is deleted automatically.

Incident response

  1. Detect and contain: suspected incidents are investigated immediately and contained within 24 hours, including rotating any affected keys.
  2. Notify: affected merchants, and Shopify where Shopify merchants are involved, are notified within 72 hours of confirming an incident, with what happened, what data was involved and what we are doing about it. Authorities are notified where the law requires.
  3. Recover and review: we restore from backups if needed and record what we changed to prevent a repeat.

Reporting a vulnerability

Please email mohsin@aicofounderhq.com. We reply within two business days.