Mintt Studio

Trust Center

Last updated: October 26, 2026

Mintt Studio

Our mission

We build Shopify apps that put social content on merchant stores. Merchants trust us with store connections and customer-facing content. On the Shopify App Store for over ten years, trusted by more than 300,000 stores.

Security and privacy as core pillars

We run industry-standard security and privacy controls for SaaS and Shopify apps, improve them as threats change, and take responsibility for the data and integrations we handle. We keep only what each app needs, never sell personal data, and delete on uninstall (see Privacy Policy and DPA). At least once a year an independent firm assesses our apps, including penetration testing. When needed, we work with security teams at Shopify, Meta, and TikTok. This page is for merchants and partners reviewing how we do that.

1. Scope

This page covers Mintt Studio Shopify apps and the systems we operate to deliver them. Integrations with Shopify and other platforms use their official APIs and documented permissions.

2. Controls

The controls below summarise how we protect merchant data and integrations. They are not a full inventory of systems or tools.

  • Platform integrations

    Shopify, Meta/Instagram, TikTok, and similar connections use official APIs and least access.

    • Official OAuth and documented platform APIs; no credential harvesting or scraping
    • Permissions limited to what each app needs to provide the service
    • Platform data is only used to operate the connected product, not for unrelated purposes
    • Connections can be revoked; related platform data is deleted when no longer needed

  • Encryption and secrets

    Protect data in transit and at rest; keep credentials out of the wrong places.

    • TLS 1.2 or higher for traffic over public networks; no cleartext transport of sensitive data
    • Production data and backups are encrypted at rest
    • Platform access tokens and app secrets are encrypted at rest, stored as secrets, and automatically rotated when the platform allows it
    • Platform access tokens and app secrets are not shipped to storefront or client apps
    • Credentials are rotated when exposure is suspected

  • Data handling

    Collect and keep only what the service needs; delete when it is no longer needed.

    • Merchant and related data removed when a shop uninstalls or disconnects, subject to legal retention
    • Deletion when no longer needed for the service, on valid request, or when a platform requires it
    • Our apps only request the Shopify permissions they need to work.
    • We do not sell merchant or customer personal data
    • Personal data details: Privacy Policy and Data Processing Addendum

  • Infrastructure, change, and operations

    Managed cloud hosting with firewalls, monitoring, on-call, reviewed deploys, and backups.

    • Firewall and edge protections in front of customer-facing services
    • Availability and error monitoring with alerting and on-call coverage
    • Application code changes go through version control and review before production
    • Security patches applied by risk as an ongoing activity
    • Admin and application audit logs retained and reviewed
    • Production data is backed up automatically.

  • Vulnerability management and testing

    Independent testing plus ongoing advisory response.

    • Most recent independent application security assessment (including penetration testing): July 2026
    • Assessments are performed at least once a year
    • Real-time automated security scans cover our cloud servers, databases, code and dependencies
    • Findings triaged by severity and tracked until fixed
    • Industry advisories reviewed when our systems are in scope
    • No public bug bounty; responsible disclosure by email is welcome

  • Incident response

    Plan for detection, containment, communication, and recovery.

    • We have an incident response process for detection, containment, communication and recovery.
    • Merchant reports of unexpected storefront behaviour are treated as high priority.
    • We report security issues to Shopify through its official channels.
    • If a personal data breach affects merchant data, we tell the affected merchants without undue delay, and in any event within 48 hours, as set out in our Data Processing Addendum.

  • Access control

    Least privilege for production systems and admin tools.

    • Multi-factor authentication for collaboration tools, admin portals, code repositories, deployment, and remote server access
    • Inventory of systems and access; access reviewed at least annually
    • Access revoked when it is no longer needed, unused, or when someone leaves
    • Day-to-day work and administrative privileges use separate accounts

  • Vendors and people

    Limit vendor access and set expectations for people with production access.

    • Our subprocessor list shows each provider's location and transfer safeguard, which we last checked in October 2026.
    • Public subprocessor list, with each provider's purpose, location and transfer safeguard.
    • Staff and contractors are bound by confidentiality obligations in their contracts.

3. Documents

4. Contact