Tendor Tendor
Trust

Trust & security

A change to your store should never be a black box. Every Tendor app is built so nothing happens that can't be seen and undone.

Reversible by design

Every change an app makes — a scheduled sale, a hidden product, a bulk SEO fix — is applied as a change set and can be rolled back to its recorded prior state.

Tamper-evident audit

Each action is written to a hash-chained log, per store. The chain is verifiable, so any gap or edit is detectable.

Isolated per store

Data is scoped to a single store at the database level with row-level security — enforced by the database, not just application code.

Reversibility

Every write to your store goes through one path: a reversible change set. We record the prior state before we change anything, so an undo restores the precise previous values rather than re-deriving them. If the store has drifted since (someone edited a price by hand), the revert detects it and skips rather than clobbering your change.

The audit trail

Actions are appended to a per-store, hash-chained audit log: each entry commits to the one before it, so the record is tamper-evident. You can see what an app did, when, and to which resources — and reverse it from that record.

Tenant isolation

Each store's data is walled off at the database layer using row-level security. Per-app tables enforce it unconditionally, and every query runs scoped to the current store, so one merchant's app can never read another's data. Isolation is a property of the database, not a promise in a policy.

Data protection & residency

Application data is hosted in the European Union. We process personal data under our Privacy Policy and, for data handled on a merchant's behalf, our Data Processing Agreement — which lists our sub-processors. We honour Shopify's mandatory data-request and redaction webhooks.

Access & encryption

Data is encrypted in transit. Access to production is on a least-privilege basis and scoped to what operating the service requires. Apps request only the Shopify scopes their function needs.

Responsible disclosure

Found a security issue? Email hello@datadir.co with the details and steps to reproduce. Please give us a reasonable window to fix it before disclosing publicly; we're grateful for reports and will credit you if you'd like.

Data-residency, retention, and sub-processor specifics are maintained in the DPA. Contact hello@datadir.co for a security questionnaire or DPA countersignature.