Security

Last updated: 25 October 2026

Confirmly handles order data for our merchants' customers, so we keep what we collect small and protect it carefully. This page explains how, and what we do if something goes wrong.

What we protect

We store only what is needed to send and track WhatsApp messages: order number and total, customer first name, phone number, and message status. We do not collect payment card details or passwords.

How we protect it

• Encryption: all traffic uses HTTPS (TLS). Data is stored in a managed database that is encrypted at rest.
• Access control: access to the database and servers is limited to the owner of Confirmly, uses strong unique passwords with two-factor authentication, and administration pages are not open to the public.
• Secrets: access tokens and API keys are kept in server configuration, never in public code or web pages.
• Separate environments: test data and production data are kept in separate databases.
• Logging: our workflow engine and database keep logs of requests, and we review them if anything looks unusual.
• Retention and deletion: we keep message records only while a store uses Confirmly. We delete a store's data after uninstall, and we delete a customer's data when Shopify forwards an erasure request.
• Backups: any database backups are created and encrypted by our database provider.

Security incident response

If we discover or suspect a security incident, we follow these steps:

1. Detect and report: anyone on the team who notices a problem tells the owner straight away. Reports from merchants or researchers are handled the same way.
2. Contain: we stop the problem from spreading, for example by rotating keys and tokens, disabling affected access and, if needed, pausing message sending.
3. Assess: we work out what happened, which stores and customers are affected, and what data was involved, using our logs.
4. Notify: we tell affected merchants without undue delay and in any case within 72 hours of confirming that their data was affected. We also notify Shopify and any other party we are required to inform, and we help merchants inform their customers where the law requires it.
5. Fix and recover: we remove the cause, restore normal service and check that the fix works.
6. Review: after every incident we write down what happened and what we changed to prevent it happening again.

Report a vulnerability

If you believe you have found a security problem in Confirmly, please email hello@tryconfirmly.com with the details. We will acknowledge your report and look into it promptly.

Contact

New Suhail Garments (Confirmly)
Shop 12-D, Sohail Garments, Rang Mahal, Lahore 54000, Pakistan
Email: hello@tryconfirmly.com