Trust and security

What you can check about Shopproof

You rely on Shopproof to show the right legal information in your shop, so you should be able to see how we work. This page sets out how we keep the rules sourced and current, where data is stored, how the apps are secured and tested, and what we have not done yet.

The rules Your data Security Testing Not done yet

The rules behind every feature

Each feature in Shopproof follows a rule in our rules data. Every rule names its legal basis, links to its source, and carries the date it applies from, a confidence level and a verification level. Our build refuses a rule that is missing any of these.

Rules published, for the EU and 8 countries: 140
Rules held back while we check them, not shown to shops: 6
Source pages linked from published rules: 105
Rules releases so far, each one in the changelog: 9

How sure we are about the 140 published rules (rules data 0.6.0, 1 November 2026)
Level	What it means	Rules
High confidence	The official text is clear about what a shop has to do and from when.	128
Medium confidence	The official text leaves room for interpretation, or some details are still to come.	12
Checked against the official text	We read the law, regulation or public authority page the rule links to.	136
Checked against a secondary source	No official page states it plainly, so the rule rests on a reliable secondary source, such as a chamber of commerce guide.	4

A rule with low confidence, an open question or no verified source is held back. The apps and this website leave it out until we have checked it.
A person reviews every rule change before it reaches a shop. Each release is listed with its date in the rules changelog, which you can also follow as a feed.
Every night an automatic check reads the source of each rule and opens a task for us when a source changes, an EU act is amended or a link stops working.
Anyone can look up the published rules for the EU and the five launch countries in the free rules checker, with the source of each one.

Where your data is

We keep as little as we can, and the privacy notice says exactly what, why and for how long. In short:

Stored in Frankfurt

What our own systems store runs on Amazon Web Services in the Frankfurt region: withdrawal records for Shopify shops, Shopify app sessions, Pro proof log stamps, the agency dashboard and the free shop check. Pages and the rules file are delivered through Amazon CloudFront, which can serve a request from outside the EU.

Stays on your server

In WooCommerce and Shopware, withdrawals, product safety details and the proof log live in your shop's own database. We never receive them. We keep no log of the daily rules download.

No Shopify data access

The Shopify app asks for 0 Shopify scopes, so it cannot read your products, orders or customers. Its storefront parts are theme app extensions.

No tracking on this site

shopproof.app sets no cookies, runs no analytics and loads nothing from other companies. Fonts are served from our own domain.

The outside services we use

Brevo (France) for the waitlist and some emails, Cloudflare for receiving email, Google for our mailbox, and Freemius (USA) as the reseller for Pro licences. Each one is named in the privacy notice.

A processing agreement for shops

The Shopify app stores withdrawal requests for you. Our data processing agreement covers that data and lists the subprocessors we use for it.

How we secure it

Security work we have in place today.

Everything we serve goes over HTTPS; plain HTTP is redirected. This site also sends a strict Content Security Policy and HSTS, needs TLS 1.2 or newer, and cannot be shown inside another site's frame.
Passwords and API keys live in AWS Systems Manager Parameter Store and GitHub's encrypted secrets, never in the code.
Our build pipeline signs in to AWS with short-lived credentials (GitHub OpenID Connect), so no AWS keys are stored in it. The role that publishes this website can change nothing else.
Code changes are made in pull requests and merged once the automated checks below pass.
Pro proof log stamps are kept for three years in storage with S3 Object Lock, so our own services cannot overwrite or delete them. Only a deliberate override by an administrator could.
A budget alarm emails us when our cloud costs rise unexpectedly, which is often the first sign of misuse.

Found a security problem?

Please email hello@shopproof.app with "Security" in the subject. We read every message and will reply. Our contact details are also in security.txt.

How we test it

Automated checks run on every pull request and once a week.

The WooCommerce plugin is tested on real WordPress and WooCommerce, from PHP 7.4 with WordPress 6.5 and WooCommerce 8.0.3 up to PHP 8.4 with the latest versions. It passes WordPress.org's Plugin Check, the WordPress coding standards and PHPStan at its strictest level.
The Shopify app runs its tests with minimum code coverage, plus linting and type checks.
On every change to the Shopware plugin, it is installed, used and removed on a real Shopware 6.7 shop.
The storefront parts both apps share, the withdrawal button and form and the product safety block, are checked against WCAG 2.2 AA with the axe accessibility engine. They take on your theme's look and never cover your theme's content.
The rules data is validated on every change, and the website checks that every rule date, ID and figure it shows matches the data.

Automated accessibility checks find many problems but not all of them. If something in a Shopproof feature is hard to use with your setup, please tell us.

What we have not done yet

So you can weigh the rest of this page fairly.

No outside company has audited our security yet.
No outside lawyer has reviewed the rules data yet. We research each rule from its official source, and the confidence level says how sure we are.
Shopproof gives technical help to display legally required information. It is not legal advice, and it does not replace a lawyer for your shop's legal texts.

Shopproof is made by Apex Point Consulting GmbH in Austria. Our company details are in the Impressum.