How we protect your data

Access

Only the people who run Tetova's engineering can reach production systems, and only through their own named accounts. Inside the Tetova dashboard, each merchant decides which areas every teammate can open. Our own staff look at a merchant's data only to give support the merchant asked for or to fix a problem.

Passwords and sign-in

Accounts on our hosting, database, telephony, AI and code providers use unique passwords of at least 12 characters, kept in a password manager, and two-factor authentication. Merchants sign in to Tetova with a one-time email code or a password, and inside Shopify they never need a separate password.

Encryption

All traffic uses TLS. Databases are encrypted at rest (AES-256), and so are their backups. Shopify access tokens and other secrets are stored encrypted and are only readable by our servers.

Keeping merchants separate

Each merchant's data is tied to their own account, and store lookups that can't tell which merchant is asking are refused instead of guessed. Larger brands run on their own dedicated database.

Logging

Database access and changes are logged by our database provider. Inside Tetova, every customer lookup and every action the AI or a teammate takes is written to an activity log the merchant can see.

Data loss prevention

We collect only what support needs and never export a merchant's customer list in bulk. Production keys live only on our servers, never in the browser or in code. Backups are encrypted, and access to them is limited to engineering.

Retention and deletion

We keep a merchant's data while their account is active. Shopify's customer and store deletion requests are processed automatically and completed within 30 days, and customer data exports are prepared on request. Details are in our privacy policy.

Testing

We build and test on Shopify development stores filled with made-up customers and orders. Merchants' real customer data is never copied into testing.

Incident response

Uptime checks and error tracking alert us to problems as they happen. If we find a security incident we contain it first, then work out what data was involved. We tell affected merchants without undue delay, and within 72 hours where the law requires it, and we notify Shopify as the Partner Program Agreement requires. After every incident we review what happened and fix the cause.

Last updated: October 19, 2026