Security

Last updated: October 14, 2026

TEKRAID apps are built and run by TEKRAID LLC, 1561 West Hamlin Road, Rochester Hills, MI 48309. This page summarizes how we protect data and our security incident response policy.

How we protect data

• Encryption. Our databases run on Render Postgres, encrypted at rest with AES-256, including all backups. Everything in transit uses HTTPS/TLS. Databases accept connections only from our app servers on a private network.
• Backups. Point-in-time recovery backups, encrypted the same way. Schema changes go through reviewed, tested migrations.
• Minimal data. Apps request only the Shopify data they need. Porchday stores no customer names, emails, phone numbers or street addresses: only the shipping country. Porchday never reads the ZIP code or address from an order or at checkout. Stockday reads only the products, quantities, prices and dates on orders, never customer details, and deletes order-derived data after 365 days.
• Access. Only the TEKRAID owner can reach production systems. Our policy requires a unique strong password and two-factor authentication on every account with production access. Access is granted on a least-privilege basis and reviewed quarterly.
• Access logging. We log reads of protected customer data, plus certain changes, deletions and staff prints (who or what, shop, order, time), without storing the data itself. Logs are kept for up to 365 days (93 days for Printday). When a customer opens a Printday document link, we record the order, the outcome, and a hashed IP address.
• Deletion. We honor Shopify's customer and shop redaction requests automatically, and delete store data after uninstall as Shopify requires.

Security incident response policy

1. Report. Anyone who suspects a security problem can email hello@tekraid.com. We treat every report as urgent.
2. Contain. We immediately rotate affected credentials, revoke access, and disable affected features or services, while preserving logs as evidence.
3. Fix and recover. We fix the root cause, test the fix, and restore data from encrypted backups if needed.
4. Notify. If merchant or customer data was exposed, we email affected merchants and notify Shopify without undue delay, and within 72 hours of confirming it, explaining what happened, what data, and what we did. We notify authorities or individuals where the law requires.
5. Review. Within two weeks we write a post-incident review and update our safeguards.

Contact

Security reports and questions: hello@tekraid.com.