---
title: "Security - Workflow Functions"
description: "What Workflow Functions is built on, where it runs, how the sandbox keeps your code away from your store's credentials, and how we keep the app up to date. No PHP anywhere."
canonical: "https://docs.workflow-functions.app/security"
---

# Security

Workflow Functions is built and operated by Code Creation Labs. This page explains what the app is made of, where it runs, how your store's data is protected and how we keep everything up to date. It is written for store owners and for anyone filling in a security questionnaire. The legal side (privacy policy, data processing agreement, sub-processors) is on [Legal & data protection](https://docs.workflow-functions.app/help/legal.md).

## What the app is built on

| Layer | What we use |
| --- | --- |
| Application code | TypeScript on Node.js, a current long-term-support release. The admin pages, the code editor and the services that run your Flow steps are one code base. |
| Function sandbox | Your code runs in an isolated V8 sandbox (isolated-vm) on a separate execution service, with a time and memory limit per run. The app's own servers never execute merchant code. |
| Database and cache | PostgreSQL (Google Cloud SQL) and Redis (Google Cloud Memorystore) |
| Hosting | Containers on Google Kubernetes Engine in Google Cloud region europe-west1 (Belgium, European Union). Databases, caches and the storage behind your functions are region-local. |
| Shopify integration | Shopify's official app libraries, Shopify Flow actions, the Admin GraphQL API through a server-side proxy, and Shopify's webhooks |
| Your storefront | Nothing runs in your theme or your checkout. |

There is no PHP, WordPress, Java or other runtime anywhere in the service. The app is listed on the Shopify App Store and passed Shopify's app review, which covers Shopify's security and protected customer data requirements.

> [!NOTE]
> **When a vulnerability is in the news**
> If an advisory concerns PHP, WordPress, Java, .NET or another technology the app does not use, it cannot affect Workflow Functions and there is nothing you need to do. If it concerns Node.js, V8, PostgreSQL, Redis or one of the libraries we use, the process under "How we keep the app up to date" applies: the fix ships with the next release, and a critical issue gets a release of its own. You are always welcome to send the advisory to support@codecreationlabs.com and we will confirm in writing whether it applies.

## How your data is protected

**In transit.** Every connection between your browser, Shopify, the sandbox and the app uses TLS. The database and the cache have no public address: they are reachable only from inside our private network.

**At rest.** All databases and storage are encrypted at rest with keys we manage in Google Cloud KMS.

**Field-level encryption on top.** The most sensitive values get a second layer: your store's Shopify access token, every secret you store for your functions and the AI provider key you may connect. Each value is encrypted individually with AES-256-GCM under a separate key in Cloud KMS, with automatic key rotation, and decrypted in memory only at the moment it is needed. Secrets are never written to logs and are never returned by the Developer API or to Sidekick.

**Your access token never enters the sandbox.** A function that needs store data receives a short-lived token that is valid for that one run only. A server-side proxy holds the real Admin API token, runs the query and returns the result, and Shopify independently enforces the permissions you granted. See [Permissions and store data access](https://docs.workflow-functions.app/permissions-and-store-data-access.md).

**Secrets.** API credentials and keys of the service itself live in Google Secret Manager and are loaded when a service starts. They are not in the code, not in the container images and not in the build pipeline.

**Data minimisation.** The app asks for no data access on install. Read and write access is granted per resource on the Permissions page through Shopify's own dialog and can be revoked at any time; a function that depends on a revoked permission is disabled instead of failing unpredictably.

## Who can access what

- **Your store only.** Every record carries the store it belongs to, and every query is scoped to the store that was authenticated. One store can never read or run another store's functions, and the storage behind your functions is partitioned per store.
- **Verified requests only.** Pages inside the Shopify admin are authenticated with Shopify session tokens. Flow steps and Shopify's own webhooks are verified by Shopify's HMAC signature before any data is touched, and a Flow step that is delivered twice is executed once.
- **The sandbox.** Your code has no file system, no raw network access and no access to the app's credentials. Its only way out is the fetch helper, which checks every address before connecting and refuses loopback, link-local, cloud metadata and private network addresses, including through a redirect. Secrets reach the function as values, never as a way to read other stores' data.
- **Optional integrations.** GitHub sync touches only the repository you choose, and AI generation sends your prompt and code to the provider whose key you connected, never to us.
- **Our team.** Production systems are reached only through Google Cloud IAM with individual accounts. Internal maintenance tools are not exposed to the internet.

## How we keep the app up to date

- **Every change is scanned before it can ship.** The pipeline runs type checks and linting, static application security testing (SAST), secret detection, dependency vulnerability scanning and container image scanning. Our release bar is zero known vulnerabilities in dependencies and in the image.
- **Runtime and operating system.** The container image, Node.js on its Alpine Linux base, is rebuilt with every release, so runtime and operating system patches ship continuously. The managed Kubernetes platform keeps the underlying nodes patched.
- **Shopify platform.** We track Shopify's API versions and the security advisories for Shopify's app libraries, and apply updates promptly. The app runs on a current Admin API version.
- **Security reviews.** An automated security audit runs before any change that touches authentication, the sandbox or the data proxy, and we conduct a full internal review of every route, data path and database query at regular intervals, most recently in October 2026.
- **Monitoring.** Availability is monitored around the clock and published on our [status page](https://crm.codecreationlabs.com/status/shopify-public-apps), and errors alert us. Operational logs are kept for at most 30 days and never contain tokens or secrets.

## Retention and deletion

- Run history, including the logs your functions print, is kept while the app is installed so that you can troubleshoot runs.
- When you uninstall the app, its access to your store is deleted immediately. Shopify's shop/redact request, which follows 48 hours after uninstall, erases the store's functions, secrets, run history and everything your functions stored.
- Shopify's mandatory privacy requests (customers/data_request, customers/redact and shop/redact) are handled automatically within the timelines Shopify sets.
- Sub-processors and the full retention schedule are in the [privacy policy](https://workflow-functions.app/privacy). A signed data processing agreement can be requested at [workflow-functions.app/dpa](https://workflow-functions.app/dpa).

## Reporting a security issue

If you believe you have found a vulnerability, or you need a security questionnaire completed, email support@codecreationlabs.com. Security reports are read and answered with priority.