Technical and Organizational Measures

About these measures

These measures describe the baseline controls used for Tomorrowfy’s hosted services as of the effective date. They are risk-based and may be improved or replaced without materially reducing the overall level of protection.

1. Security organization and responsibility

• Security matters are coordinated through security@tomorrowfy.com; privacy matters through privacy@tomorrowfy.com.
• Access to Customer Data is limited to personnel who need it for engineering, operations, support, security, or legal compliance.
• Authorized personnel are subject to confidentiality obligations.
• Security requirements are considered when changing infrastructure, application code, and vendors.

2. Physical access

• Tomorrowfy operates cloud-first and does not host production servers at its office.
• Office access is restricted using electronic key fobs.
• Production infrastructure is hosted in provider-operated data centers with physical and environmental security controls and independent assurance programs.
• Company devices are securely wiped or reset when retired or reassigned.

3. Identity and access management

• Google Workspace is the central identity platform for internal access.
• Multi-factor authentication is required for sensitive tools, production environments, and administrative consoles.
• Access is role-based and granted on a need-to-know and least-privilege basis.
• Access is changed or removed when responsibilities change or personnel leave.
• Unique credentials are used; shared administrative credentials are avoided where the provider supports individual accounts.
• Production application credentials and tokens are kept out of source code and supplied through managed secrets or protected environment configuration.

4. Application and environment controls

• Development, staging, and production environments are separated.
• Production Customer Data is not used in development unless anonymized or otherwise specifically protected and authorized.
• Source code is version-controlled in private GitHub repositories.
• Backend deployments use automated tests and a controlled CI/CD workflow before deployment to Google Cloud.
• Authentication, request validation, and authorization checks are implemented for administrative, merchant, storefront, and webhook interfaces according to their trust model.
• Dependencies and infrastructure can be updated through version-controlled application and Terraform configuration.

5. Encryption and secrets

• External network traffic is protected with HTTPS using TLS 1.2 or later where supported.
• Google Cloud and Vercel encrypt stored production data using their platform encryption controls.
• Sensitive Shopify tokens and integration credentials stored by the application are encrypted using application keys or protected provider secret storage.
• Encryption and signing keys are separated from application source code and access is restricted.
• Full payment-card numbers are not intentionally stored by Tomorrowfy; payment processing remains within Shopify's payment environment.

6. Logging, monitoring, and traceability

• Google Cloud Logging, Monitoring, Trace, and service audit capabilities are used for production operations and investigation.
• Vercel provides deployment and runtime logs for the hosted frontend; Vercel Speed Insights is enabled for production performance monitoring.
• Application logs include operational context needed to diagnose events and are access-restricted.
• Administrative and infrastructure changes are traceable through cloud audit records, version control, and deployment history.
• Logs are protected against unauthorized access and retained according to provider and service configuration.

7. Availability and recovery

• Primary backend services, Firestore, and BigQuery are deployed in Google Cloud region europe-west3 (Frankfurt), using provider replication within the region.
• The service can be redeployed from version-controlled code and infrastructure configuration.
• Firestore point-in-time recovery (PITR) retains recoverable document versions for the preceding seven days, with recovery points available at one-minute granularity. Historical data can be read, exported, or cloned using provider-native recovery mechanisms.
• No separate scheduled Firestore backup, cross-region replica, or independently administered recovery copy is included in the standard service. Unless an Order Form states otherwise, Firestore recovery points older than the seven-day PITR window are not retained.
• BigQuery is configured with a seven-day time-travel window and may contain application logs or revision history for forensic analysis. It is not a Firestore backup or automatic continuity mechanism.
• Where the Customer enables Reverse ETL, selected datasets are copied daily to a Customer-designated BigQuery project. The Customer controls retention and recovery for that destination. Reverse ETL is not a Firestore backup, Firestore replica, or guaranteed disaster-recovery mechanism.
• Tomorrowfy tests recovery procedures at least annually and after material changes to the recovery configuration, and documents the results.
• Recovery relies on provider resilience and available native recovery mechanisms. No fixed recovery point objective (RPO) or recovery time objective (RTO) is promised unless expressly stated in an Order Form.
• The standard availability objective is defined in the Service Level and Support Policy.

8. Incident management

• Reported or detected security events are triaged, contained, investigated, remediated, and documented according to severity.
• Access, logs, and relevant evidence are preserved where needed for investigation and legal duties.
• Affected credentials are rotated or revoked when compromise is suspected.
• Personal data breaches are communicated to affected Customers under the DPA, without undue delay and where feasible within 24 hours after awareness.
• Corrective actions are tracked after material incidents.

9. Data minimization, separation, and deletion

• Customer tenants are logically separated using shop-specific identifiers and access controls.
• Only data needed for configured product functions, support, security, and legal compliance is processed.
• Customer-directed exports and integrations are separated by Customer configuration and credentials.
• Authorized personnel perform deletion and redaction requests; Customer personal data in Tomorrowfy-controlled active production systems is deleted within 30 days after termination or a lawful instruction, subject to legal retention.
• Residual provider-managed copies age out under the applicable provider retention cycle and remain protected until deletion.

10. Vendor and transfer management

• Service providers are reviewed for their role, security commitments, data locations, and data-protection terms before material production use.
• Subprocessors are contractually bound to appropriate confidentiality, security, assistance, and deletion obligations.
• Restricted international transfers use an adequacy decision, the 2021 Standard Contractual Clauses, or another valid Chapter V GDPR mechanism.
• The current vendor roles, locations, and transfer mechanisms are documented in the Subprocessor and Data Location List.

11. Current architecture summary

Contacts

• Security: security@tomorrowfy.com
• Privacy: privacy@tomorrowfy.com
• Support: support@tomorrowfy.com