Security
Built for Shopify's trust model
Shopper card data never touches Sublyra. App charges go through Shopify Billing.
Checkout & cards
Native Shopify checkout only. Shopper payment card data never touches Sublyra servers.
Authentication
Shopify session and offline tokens for Admin API access. Merchants authorize scopes at install via Shopify managed install.
App billing
Pro plans, trials, and add-ons use the Shopify Billing API and appear on the merchant’s Shopify invoice — not off-platform card forms on this site.
Secrets & credentials
Integration credentials and tokens are stored with encryption at rest and least-privilege access for operators.
Transport security
HTTPS / TLS for app and website traffic. Admin API calls go over Shopify’s authenticated channels.
Hosting
Production app runs on a hardened VPS (Hetzner). Marketing site is served separately. We do not claim SOC 2 or similar certifications we have not completed.
Merchant control
Uninstall removes app access per Shopify’s lifecycle. Contact us for data export or deletion requests related to your shop.
Questionnaires
Security or vendor review questionnaires: email support@sublyra.com. We’ll answer based on current practices — no invented certifications.
Also see our Privacy Policy and DPA.
Report a concern
If you believe you’ve found a security issue in Sublyra, email support@sublyra.com with details. Please don’t publicly disclose until we’ve had a chance to respond.