Beacon Messenger

Security

Last updated September 26, 2026.

Beacon Messenger is built and operated by Beacon Wave Studio. This page describes the controls we apply to the personal data the app handles — customer names, phone numbers and addresses used to fill WhatsApp templates — and how we respond if something goes wrong. What we store and why is covered in the privacy policy.

Data minimisation

The app requests only the Shopify scopes it needs (orders and fulfillments) and keeps from each order only the fields a message template uses. The storefront chat button runs entirely inside Shopify and sends nothing to our servers. Message log entries and access records are deleted automatically after 12 months, and everything about a store is deleted when the app is uninstalled.

Encryption

All traffic between shoppers, merchants, Shopify, Meta and our servers uses TLS. Merchants' WhatsApp access tokens and app secrets are encrypted with AES-256-GCM before they are written to the database, using a key that lives only in the application's runtime configuration. The database is not reachable from the public internet; it is only addressable from the application container on a private network. The database is backed up daily; backups are kept for two weeks on the same host, whose disk is encrypted at rest.

Access control

Production systems (hosting console, database, Shopify Partner account, source repository) are accessible only to Beacon Wave Studio staff who operate the app, each with an individual account, a unique generated password and two-factor authentication. There are no shared accounts. Staff do not access customer data in the normal course of operating the service; when a support request requires it, the access is limited to the store that raised the request.

Inside the app, every store can only ever see its own data: all queries are scoped to the authenticated store, and Shopify's session tokens identify the staff member behind each request.

Access logging

The app writes an audit record every time personal data is viewed or changed: when a merchant opens or searches the message log, retries a message, and when Shopify sends a customer data request, customer erasure or store erasure webhook. Each record notes the store, the Shopify user, the action and the filters used. Audit records are kept for 12 months alongside standard server request logs.

Separation of environments

Development and testing happen against Shopify development stores and a local database; production data is never copied to development machines. Production configuration and secrets exist only in the production deployment.

Data loss prevention

We reduce the ways data could leave the system: the app has no bulk export, no third-party analytics or tracking scripts, and no integrations other than Shopify and Meta's WhatsApp Business Platform. Secrets are held in the deployment platform, never in source control. Dependencies are kept current and the container is rebuilt from a pinned base image on every deploy. Retention limits mean there is less data to lose, and the audit log lets us reconstruct who accessed what if we need to.

Incident response

If we suspect that personal data has been exposed, lost or altered, the on-call operator acts as incident lead and follows this plan:

  1. Detect and triage — from hosting alerts, logs, a merchant report or a security researcher. Classify severity: high (customer data or credentials exposed), medium (integrity or availability of a merchant's data affected), low (no personal data involved).
  2. Contain — within hours for high severity: revoke and rotate the affected secrets (Shopify client secret, database credentials, encryption key), take the deployment offline if needed, and preserve logs and evidence.
  3. Assess — determine which stores and which customers' data were affected, using the audit log and database records.
  4. Notify — affected merchants by email within 72 hours of confirming a high-severity incident, with what happened, what data was involved and what we have done; Shopify through Partner Support; and regulators where the merchant's law requires it. Merchants are responsible for notifying their own customers, and we give them the information they need to do so.
  5. Recover and learn — restore service, fix the root cause, and write a short post-incident review with follow-up actions.

Reporting a vulnerability

Please email hello@beaconwavestudio.com with details and steps to reproduce. We acknowledge reports within two business days and will not take action against good-faith research.