How we protect store data
What Zevron does with the data it needs to win chargebacks, in one line each.
Access
Narrow store access
We read orders, customers and fulfilments. We write only dispute evidence.
Verified webhooks
Every Shopify webhook, OAuth return and alert feed is checked against its HMAC signature.
Private case links
Merchant pages open with an unguessable 144-bit link the desk can rotate at any time.
Signed sessions
HMAC-signed, HTTP-only cookies that expire after 14 days. Disabled accounts lose access at once.
Strict browser security
HTTPS only (HSTS), a per-request content security policy, no framing, no sniffing. Check the grades below.
Storage
Encrypted credentials
Shopify, Stripe and subscription-app tokens and Slack webhooks are stored with AES-256-GCM.
Deleted on uninstall
Everything for a store is deleted 48 hours after it uninstalls.
Short error logs
Error reports are kept 30 days, then deleted.
People
A person approves filings
A reviewer signs off each response, unless you turn on auto-file for high-scoring cases.
Audit log
Case decisions, settings and team changes are logged with who and when. Secrets never are.
Hashed passwords, two-factor
Salted scrypt, authenticator-app two-factor for the review team, and a 15-minute lock after eight wrong attempts.
Vulnerability disclosure
A published policy with safe harbor, and a security.txt contact.
Your rights
Your data, on request
Download everything we hold for your store, or close your account and have it erased, from your page.
Customer erasure
A redact request strips the shopper's name, email, evidence, uploads and draft text.
Public status
Live health checks and 90 days of uptime and incidents on our status page.