Security

Last updated: October 19, 2026

This page describes how Valcomm tech Oy protects the data in Click Context. The privacy policy lists what we collect. The sub-processor list names every provider.

Certification status

Valcomm tech Oy does not hold ISO 27001 or SOC 2 certification, and we have not yet had an external penetration test. We answer security questionnaires on request. Our hosting provider (Vercel) and database provider (Neon) each have SOC 2 Type 2 reports.

Hosting and data location

• The app and API run on Vercel.
• The database is PostgreSQL on Neon, in the AWS us-east-1 region (United States).

Encryption

• All traffic to the app, the API and the tracker uses HTTPS (TLS).
• Neon encrypts the database storage at rest.
• Vercel encrypts the environment variables that hold our service credentials.

Credentials and secrets

• Service credentials (database, AI provider, Shopify app secret) are Vercel environment variables. They are not in the source code.
• We store AI tool credentials only as SHA-256 hashes: API keys, OAuth client secrets, access tokens and refresh tokens. We show an API key once, when the merchant creates it.
• OAuth access tokens expire after 24 hours. Refresh tokens expire after 30 days. Connection codes work once and expire after 10 minutes.
• We check the HMAC signature on every Shopify webhook. Requests from the Shopify admin carry a Shopify session token that we check on the server.

Access to store data

• Shopify scopes: the app asks Shopify only for read_products, read_themes, write_pixels and read_customer_events. It cannot read orders, customers or payments, and it cannot change products, prices, stock or themes.
• One store per credential: each AI tool credential belongs to one store. The server finds the store from the credential on every request, so a credential cannot read another store.
• Read-only by default:AI tools can only read data. The two tools that create and delete custom event rules work only after the merchant turns them on in the app's Settings.
• Revocation: the merchant can disconnect each AI tool or revoke the API key in the app, and access stops at once. Uninstalling the app stops access for every credential.
• Audit: we record each AI tool call with the tool name, the store and the type of credential. The app shows when each connected tool last used its credential.
• Staff access: access to production systems is limited to company staff who need it. Each person uses their own account.

Data retention and deletion

Raw visitor events expire after 14 to 90 days, depending on the plan. When a store uninstalls the app, we delete all of its data when Shopify sends the shop/redact request, 48 hours after uninstall. See section 8 of the privacy policy.

Incident response

• If we confirm a breach that affects store data, we notify each affected merchant by email without undue delay, and no later than 72 hours after we confirm it.
• The notice says what happened, which data it affected, what we did and what the merchant should do.

Report a vulnerability

Email privacy@clickcontext.comwith the details. Do not access other merchants' data or disrupt the service while you test. We reply within 3 business days.