This page describes the controls that are in place today. A completed security questionnaire and architecture details are available on request at hello@punchrelay.com. For how personal data is used, see the privacy policy.
Where the service runs
- The app and its database run in netcup GmbH's data centre in Vienna, Austria (EU). The database and the application listen only on the server itself.
- Requests to the app gateway (relay.punchrelay.com) pass through Cloudflare's proxy and firewall before they reach the server. Cloudflare also adds its Web Analytics beacon to the app's pages, which counts page views and measures load times without cookies.
- The marketing website, punchrelay.com, runs separately on Cloudflare and holds no merchant or buyer data.
- PunchRelay is operated from Hanoi, Vietnam. Authorised PunchRelay personnel reach the server from there to run the service and answer requests.
Encryption in transit
- The app is served over HTTPS only. Plain HTTP requests are redirected to HTTPS, and the gateway sends HTTP Strict Transport Security (one year, including subdomains).
- Calls from the app to Shopify's APIs use HTTPS. In production the app returns carts and posts back to buyer systems only over HTTPS return URLs.
Encryption of credentials and backups
- Shopify access tokens and buyer credentials (shared secrets and OCI passwords) are encrypted with AES-256-GCM. The key is kept outside the database and outside its backups.
- Database backups are encrypted before they leave the server (see below).
Backups and recovery
- The database is backed up daily. Each backup is encrypted with
ageon the server and copied to a private Cloudflare R2 bucket in Cloudflare's EU jurisdiction. After every upload the backup is downloaded again in full and its SHA-256 checksum compared. The key that decrypts backups is held separately from the server. - Restore has been tested: on 13 September 2026 a production backup was downloaded from R2, decrypted with the separately held key and restored into a disposable database with the expected schema and record counts. The full recovery procedure, including re-applying privacy erasures, was rehearsed on disposable databases on 23 September 2026.
- Erasures do not come back with a restore. Every Shopify privacy erasure is also recorded off the server, in a separate R2 bucket in the EU, as keyed hashes with no readable personal data. After a restore those records are used to erase the same data again.
Access control and logging
- Merchant staff use the app inside the Shopify admin. Every request is checked against a Shopify session token, and every database query is limited to that merchant's store.
- Every read by merchant staff is recorded before the data is returned, with the store, the Shopify staff user ID and the route. Opening a purchase order document or downloading a privacy export is recorded with that record's ID. Audit records hold no order content.
- Protocol logs keep the cXML and OCI messages for troubleshooting. Shared secrets, passwords and authorization tokens are removed before a message is stored, and a procurement card (PCard) number on a purchase order keeps only its last four digits, with the expiry date removed. A request that never authenticates keeps only its metadata (time, size, claimed sender identity and outcome) and at most the first 4 KB of the redacted message. The web server keeps no access log, because OCI login URLs can carry passwords. Application and error logs, which can contain IP addresses, are rotated automatically.
- Administrative access to the server, the database and the backup storage is restricted to authorised PunchRelay personnel. Support lookups into a merchant's data need a grant and are recorded.
Monitoring and incidents
- A monitor runs every minute on the server. It checks the app's health endpoint, backup freshness and the R2 copy, disk space, the job queue, the daily retention job, privacy request deadlines and the off-server erasure records, and alerts PunchRelay when a check fails.
- Incidents follow a written runbook: record, contain, establish scope, notify, fix and review. Merchants affected by a personal data breach are told without undue delay.
Shopify protected customer data
Shopify approved PunchRelay's access to protected customer data on 12 October 2026, together with the App Store approval. The app asks for customer names, email addresses and addresses. It uses them to show the merchant the right B2B contact and to put the buyer's shipping and billing addresses on the order. It does not request phone numbers. This approval is Shopify's review of the app's data use and protection answers, not an independent audit.
Retention and deletion
- Punchout sessions and protocol logs: 90 days.
- Requests that never authenticate, and our answers to them: 7 days.
- Purchase order contents, including addresses: 90 days. A deduplication record without the order contents stays so the same PO never becomes two Shopify orders.
- Support diagnostics: 30 days.
- Encrypted database backups: 30 days.
- Off-server erasure records (keyed hashes only): 45 days.
- When a merchant uninstalls the app, its Shopify access tokens are deleted and its buyer connections disabled at once. Shopify's
shop/redactrequest, about 48 hours later, deletes the store's remaining data.customers/redacterases one customer's data within 30 days.
The privacy policy lists every category and its period.
Sub-processors
These providers process merchant or buyer data for the app. The data processing agreement lists them as its Annex 3 and sets out how we announce a change. The privacy policy also lists the providers used for this website.
| Provider | Location | What it does for PunchRelay | Personal data involved | Transfer mechanism |
|---|---|---|---|---|
| netcup GmbH | Karlsruhe, Germany. Our server is in netcup's Vienna, Austria location. | Hosting of the application server and the primary database. | All data the service processes. | None: EU. |
| Cloudflare, Inc. | USA, global network. R2 storage in Cloudflare's EU jurisdiction. | Proxy, TLS and firewall in front of the app gateway (relay.punchrelay.com). R2 object storage for encrypted database backups and for the erasure ledger. Web Analytics, a cookieless beacon that Cloudflare adds to the app's pages to count page views and measure load times. | All requests to and from the app pass through Cloudflare. Backups are encrypted before upload. The erasure ledger holds keyed hashes of identifiers, no readable personal data. Web Analytics receives the merchant staff's IP address, browser details and the app pages they open. | EU-US Data Privacy Framework, and the Standard Contractual Clauses in Cloudflare's data processing terms. |
| Resend (Plus Five Five, Inc.) | USA. Our sending domain uses Resend's EU region (Ireland). | Delivery of the emails the app sends to merchant staff, such as the notice that a purchase order awaits approval. | Recipient name and email address. Purchase order notices also contain the PO number, connection name, line items and total. | EU-US Data Privacy Framework. |
| Brevo (Sendinblue SAS) | Paris, France. | Fallback email delivery, used only when Resend is not configured. | The same as Resend. | None: EU. |
| Google LLC | USA. | The Gmail mailbox for hello@punchrelay.com, where support email from merchants arrives. | Whatever a merchant sends us by email, and our replies. | EU-US Data Privacy Framework, and the Standard Contractual Clauses in Google's data processing terms. |
Reporting a vulnerability
Email hello@punchrelay.com with a description, the steps to reproduce it and the URLs involved. Please test only against your own store or a development store, do not access or change other merchants' data, and do not run denial of service or spam tests. We confirm receipt, keep you informed while we fix the issue, and credit you if you wish. The same contact is published in security.txt.