Security

Built to know as little about shoppers as it can

Growth Dept CRO needs to know which group a visitor saw and whether Shopify recorded an order. It stores that and very little else.

No shopper PII stored
No names, emails, phone numbers, addresses or IP addresses in any table. Customer ids are hashed with your brand's own key, and message recipients are salted hashes.
Brands walled off
Postgres row-level security limits every request to one brand, under a database role that cannot switch it off.
Orders from Shopify, not browsers
A purchase counts only when Shopify's own order record backs it, so a forged event cannot move a result.

Access

Access and credentials

Access by role
Owners, admins, members and viewers per organization. Sign-in is with Google, or a password with optional two-step codes.
Store credentials protected
A custom-app token is encrypted with AES-256-GCM before it is stored. For brands Growth Dept works with, the platform gets short-lived tokens and the real ones stay on Growth Dept's own server.
Support visits logged
Growth Dept staff can open a brand read-only to help with support, and each visit is written to the audit log.
AI reads aggregates only
The assistant asks the brand's own Growth Dept agent with a brief of tests, groups, results and store facts, and an opaque id for the person asking. Nothing of the question or answer is kept on Growth Dept's side.

Details

Exposures and page views, and from the pixel: add to cart, checkout and purchase events, each with the visitor's groups.
A random visitor id and the visitor's groups, kept in the brand's own _cro cookie for one year (Safari deletes cookies a page's script sets after 7 days).
No IP address, email, name, phone number or street address is stored. Bots and malformed batches are dropped at the collector.

The order id and the money fields results need: subtotal, total, shipping, discounts, tax and refunds, in the store's currency, and the number of items.
The customer id and the order's email address only as hashes under a key that belongs to your brand, so a shopper cannot be matched across brands and the address is never stored. Post-test results use them to follow a test customer's later orders, guest checkouts included.
Whether it was a first order or a subscription order, for the results that use them.

Every table that holds brand data carries the brand's id, and row-level security limits each transaction to one brand.
The application connects as a role that cannot bypass row-level security.
Each brand has its own public key for the storefront and its own API keys, stored only as hashes.

The app runs on Vercel in the US East region, and the database is Neon Postgres in AWS US East.
Platform secrets live in Vercel's encrypted environment variables.
Raw events, sessions and unconfirmed purchase claims are deleted after 400 days by default. Test results are kept.

Report a security issue to hello@growthdept.ai with “Security” in the subject line.

Book a 45-minute call with the Growth Dept team. We look at your store and your traffic, and tell you which tests to run first.