Security

Workflow Forms is built and operated by Code Creation Labs. This page explains what the app is made of, where it runs, how your visitors' data is protected and how we keep everything up to date. It is written for store owners and for anyone filling in a security questionnaire. The legal side (privacy policy, data processing agreement, sub-processors) is on Legal & data protection.

What the app is built on

Layer	What we use
Application code	TypeScript on Node.js, a current long-term-support release. The admin pages, the form renderer and the services that store submissions and start Shopify Flow are one code base.
Database and cache	PostgreSQL (Google Cloud SQL) and Redis (Google Cloud Memorystore)
Hosting	Containers on Google Kubernetes Engine in Google Cloud region europe-west1 (Belgium, European Union). Databases, caches and file storage are region-local.
Shopify integration	Shopify's official app libraries, Shopify Flow triggers, Shopify's app proxy and Shopify's webhooks
Your storefront	A theme app extension. The Form block, the popup app embed and the direct link page are rendered by your theme, and a small script talks to the app through Shopify's app proxy on your own domain. No external service is loaded, unless you pick a Google Font under Branding.

There is no PHP, WordPress, Java or other runtime anywhere in the service. The app is listed on the Shopify App Store and passed Shopify's app review, which covers Shopify's security and protected customer data requirements.

How your data is protected

In transit. A visitor's submission travels over TLS from their browser to your own domain, through Shopify's app proxy to the app. The database and the cache have no public address: they are reachable only from inside our private network.

At rest. All databases and storage are encrypted at rest with keys we manage in Google Cloud KMS.

Field-level encryption on top. The submitted values of every submission, and your store's Shopify access token, get a second layer: each record is encrypted individually with AES-256-GCM under a separate key in Cloud KMS, with automatic key rotation. The values are decrypted in memory only when a submission is opened, exported or handed to Shopify Flow, and they are never written to logs. Lists in the admin and in the API show who submitted when; the answers are opened one at a time.

Secrets. API credentials and keys of the service itself live in Google Secret Manager and are loaded when a service starts. They are not in the code, not in the container images and not in the build pipeline.

Data minimisation. The app asks for no access to your store's data at all. The only Shopify data it receives is the id of a logged-in customer, which Shopify adds to the signed proxy request. If you turn on the metaobject copy for a form, the app writes to its own metaobject definition and nothing else.

Who can access what

• Your store only. Every form, field and submission carries the store it belongs to, and every query is scoped to the store that was authenticated. One store can never read another store's submissions.
• Verified requests only. Pages inside the Shopify admin are authenticated with Shopify session tokens. Every storefront request arrives through Shopify's app proxy and is verified with Shopify's signature; Flow callbacks and Shopify's own webhooks are verified by Shopify's HMAC signature before any data is touched.
• Nothing the browser claims is trusted. Every submission is validated on the server: required fields, formats, lengths and patterns, with every value capped in size. Conditions are evaluated again on the server, so a field that was hidden is never stored. The spam checks (an invisible trap field, a signed minimum fill time, a limit per visitor and your blocked email domains) run there too, and a submission they catch is stored nowhere. See Spam protection.
• No injected content. Your own texts allow a small, sanitised set of HTML. What a visitor types is never rendered as HTML, and the CSV export is written so that a value cannot execute as a formula when opened in a spreadsheet.
• Our team. Production systems are reached only through Google Cloud IAM with individual accounts. Internal maintenance tools are not exposed to the internet.

How we keep the app up to date

• Every change is scanned before it can ship. The pipeline runs type checks and linting, static application security testing (SAST), secret detection, dependency vulnerability scanning and container image scanning. Our release bar is zero known vulnerabilities in dependencies and in the image.
• Runtime and operating system. The container image, Node.js on its Alpine Linux base, is rebuilt with every release, so runtime and operating system patches ship continuously. The managed Kubernetes platform keeps the underlying nodes patched.
• Shopify platform. We track Shopify's API versions and the security advisories for Shopify's app libraries, and apply updates promptly. The app runs on a current Admin API version.
• Security reviews. We conduct a full internal review of every route, data path and database query at regular intervals, most recently in October 2026.
• Monitoring. Availability is monitored around the clock and published on our status page, and errors alert us. Operational logs are kept for at most 30 days and never contain submitted values, tokens or secrets.

Retention and deletion

• Submissions are kept until you delete them, one by one or in bulk, in The submissions inbox. Refused submissions are never stored.
• When you uninstall the app, its access to your store is deleted immediately. Shopify's shop/redact request, which follows 48 hours after uninstall, erases the store's forms, fields and submissions.
• Shopify's mandatory privacy requests (customers/data_request, customers/redact and shop/redact) are handled automatically within the timelines Shopify sets: a customer's redaction request deletes the submissions linked to that customer.
• Sub-processors and the full retention schedule are in the privacy policy. A signed data processing agreement can be requested at workflow-forms.app/dpa.

Reporting a security issue

If you believe you have found a vulnerability, or you need a security questionnaire completed, email support@codecreationlabs.com. Security reports are read and answered with priority.