Data protection and incident response

Last updated: 2026-10-15

How Brisa Works protects the personal data its tools handle, and what happens if something goes wrong. It covers every tool; the Shopify app (Click & Drop Customs) is the one that handles customers' names, addresses, emails and phone numbers, so most of the detail is about it. See also the privacy policy, the security page and the data processing agreement.

What personal data we hold

• Click & Drop Customs (Shopify): the app reads an order's shipping name, address, email and phone at the moment it sends the order to the merchant's own Royal Mail Click & Drop account, and passes them straight on. They are never stored in our database, logs or backups. Error text is redacted before it is written, and webhook payloads are never logged. What we store per order: Shopify order ID and number, Click & Drop order number, destination region, status.
• Google Workspace add-ons: task and sheet data stay in the user's Google account; our licence server stores the user's email, plan and subscription status.
• JetBrains plugins and Apify Actors: nothing on our servers.

Encryption and backups

• All traffic uses TLS. Our databases are Cloudflare D1, encrypted at rest by Cloudflare.
• Backups are D1's Time Travel point-in-time restore, which Cloudflare keeps encrypted at rest inside the same account. We do not export database copies to other places or devices.
• API keys merchants give us (Click & Drop) are encrypted with AES-256-GCM under a key held in Cloudflare's secret store, bound to the shop.

Test and production are separate

The development store and every test install use a separate staging app, Worker and database (clickdrop-customs-sync-staging, database clickdrop-staging). Production data is never copied to staging, and tests use invented data only (names such as "Test Customer", example.com addresses, 07700 900xxx numbers).

Data loss prevention

• Minimisation: we keep no customer personal data, so there is none to lose; automated tests fail the build if a name, address, email or phone from the test orders reaches the database or the logs.
• Retention: sync log 30 days, access log 90 days, sync status while installed; everything for a shop is deleted at once on uninstall or shop/redact, and an order's rows on customers/redact.
• No copies: no exports, no customer data in email or support tickets (we ask merchants for order numbers, never addresses), no personal data in error reports.

Who can access what

• One operator (the owner) has access to production systems. There is no staff access path to customer personal data: the app reads it only to send an order, and no admin screen or query shows it.
• Every account that can reach production (Cloudflare, Shopify Partners, Google, Paddle, JetBrains, Apify, the email domain) uses a unique password of at least 16 random characters from a password manager and two-step verification. No shared credentials. Secrets live only in Cloudflare's secret store and an encrypted local file.

Access log

Every time the Shopify app reads an order's protected fields, and every time it hands them to Click & Drop, it writes an access record: shop, order ID, action, purpose and which part of the app did it (webhook, scheduled sweep, or a merchant's Retry). The record holds no personal data, is kept 90 days and is deleted with the shop or the order. Access to the Cloudflare account itself is recorded in Cloudflare's audit log.

Security incident response

1. Detect. Alerts and reports arrive at security@brisaworks.com and support@brisaworks.com; Cloudflare and store notices go to the same mailbox.
2. Contain (same day). Rotate the affected secrets (wrangler secret put), revoke tokens, disable the affected Worker route or roll back to the previous deploy, and preserve the logs and access log.
3. Assess (within 24 hours). Which shops, users and data were affected, using the access log, Cloudflare's audit log and the sync log.
4. Notify. Affected merchants and users without undue delay and within 48 hours of becoming aware of a breach affecting their data; Shopify through the Partner Dashboard for incidents involving Shopify data; the Spanish Data Protection Agency (AEPD) within 72 hours where the GDPR requires it, as controller or by informing the controller when we act as processor.
5. Fix and review. Deploy the fix with a test that reproduces the cause, record what happened and what changed, and update this page if a practice changes.

Contact: security@brisaworks.com (vulnerabilities and incidents), support@brisaworks.com (everything else).