Security

tResolv handles sensitive data, your Shopify credentials, your Gmail inbox, your customers' order details, so we've built the platform around a few concrete security practices. This page describes what's actually implemented today, not a compliance checklist. We're a small team and don't hold formal certifications like SOC 2 or ISO 27001 yet.

Encryption

Sensitive credentials, including your Shopify access token, are encrypted at rest using AES-256-GCM before they're stored. All traffic between your browser, our dashboard, and our backend is encrypted in transit over HTTPS.

Authentication

Dashboard access is protected by JWT-based authentication. Account passwords are never stored in plain text, they're hashed with bcrypt, a one-way hashing algorithm designed specifically to resist brute-force attacks.

Tenant isolation

tResolv is multi-tenant: every merchant's tickets, orders, and knowledge base are scoped to their own account at the database level. One merchant's data is never visible to another, and this boundary is enforced on every request, not just in the dashboard UI.

Audit logs

Financial actions, refunds and order cancellations, are recorded in an append-only audit log: who took the action, when, and the result. These records can't be edited or deleted after the fact.

Rate limiting

API endpoints, particularly ones that trigger financial actions or send messages, are rate-limited to prevent abuse and reduce the impact of a compromised account or runaway integration.

Data handling

We collect only what's needed to run the service: your account details, the Shopify order data required to answer customer questions, and the support emails in your connected inbox. Email content is automatically deleted after 90 days. We don't sell data, and we don't use merchant or customer data to train AI models. See our Privacy Policy for the full detail.

Third-party services we use

We rely on a small number of established providers to run tResolv, each scoped to only the access it needs:

• Mistral AI (France, EU), powers our AI replies
• Supabase (EU region), stores account and ticket data
• Google Gmail API, reads and sends emails via your connected account
• Render.com, hosts our backend
• Vercel, hosts our dashboard and website

None of these providers are permitted to use your data for their own purposes.

Reporting a concern

If you believe you've found a security issue, please email us, we take these reports seriously and will respond promptly.