Security & data protection

Last updated: November 7, 2026

How Brivano Labs protects the data Dockline handles for Merchants and their retailers' end customers. What data we collect and why is in the Privacy Policy.

Minimum data, one purpose

We only read and keep what is needed to fulfill retailer dropship orders: the order, its items, and the end customer's ship-to details. We do not read the Merchant's own web-store customers, we do not sell or share personal data, and we do not use it for marketing, profiling or automated decisions about people.

Encryption

• In transit: every connection to the App, Shopify and Rithum uses HTTPS (TLS).
• At rest: the App's database and files live on an encrypted disk at our host, Render; Render's automatic daily backups (snapshots) are encrypted too. Shopify access tokens and Rithum credentials are additionally encrypted with AES-256-GCM.

Retention and deletion

• End-customer name, address, phone and messages are deleted automatically 90 days after an order is shipped or cancelled.
• Customer erasure requests from Shopify are applied to the related orders; a store's data is deleted entirely when Shopify asks us to after uninstall.
• Backups expire on their own after about 7 days, so deleted data leaves the backups within that time.

Test and production data

We develop and test with fake data and Shopify development stores. Merchant and end-customer data from live stores is never copied into development or test environments.

Data loss prevention

• Encrypted daily backups of the database, kept for at least 7 days.
• Every update to a retailer is queued and retried until it is delivered; failures alert the Merchant instead of being lost.
• Personal data never leaves the production server except to Shopify and Rithum for the order it belongs to; it is not exported to spreadsheets, email or personal devices.

Access control

• Only authorized Brivano Labs staff who need it for support or operations can reach production data, and only through accounts protected by strong, unique passwords and two-factor authentication (hosting, code, Shopify Partners, email).
• Merchants only ever see their own store's orders.
• Every read of order data — by a Merchant in the App, by packing-slip downloads, or by our staff through the admin API — is written to an access log (who, which store, when), kept for one year.

Incident response

If we suspect a security incident involving personal data, we:

1. Contain it right away: revoke or rotate the affected keys and tokens, block the access path, and pause syncing for affected stores if needed.
2. Investigate with the access log, host logs and backups: what data, which stores, which people, and how.
3. Notify affected Merchants and Shopify without undue delay and within 72 hours of confirming the incident, with what happened, what data was involved and what we are doing; and notify authorities or individuals where the law requires.
4. Fix and review: remove the cause, restore from backup if needed, and record the incident and the lessons learned.

Report a security issue to hello@brivanolabs.com; we answer within one business day.