SETROASFLOW — DPA ANNEX: TECHNICAL AND ORGANIZATIONAL MEASURES

Version: Draft — 25 August 2026

1. ACCESS CONTROL

Authorized SetRoasFlow personnel may have technically possible administrative access to production data stores when necessary to operate, maintain, debug or support the Service.

The operator may technically access:

• Supabase account/project/configuration data;

• destination credentials stored for connected integrations;

• the Supabase events table, which does not contain clear PII but may contain pseudonymous or otherwise linkable information;

• Cloudflare D1/Durable Objects customer profiles, including clear email where collected with consent.

The Service does not claim that technical barriers make customer data inaccessible to the operator. The restriction is organizational and contractual, and routine access to end-customer data is not performed.

2. SECURITY CONTROLS

• TLS for network transport.

• HMAC verification for Shopify webhooks and supported signed requests.

• Constant-time signature comparison.

• Signed OAuth state.

• HMAC-SHA256 signed cookies.

• Secure, HttpOnly master cookie with SameSite=Lax.

• Platform-managed secrets; no secrets intentionally embedded in source code.

• Merchant platform credentials stored server-side and used server-side.

• SHA-256 hashing of identity data before advertising egress.

• Backend-only service-role database access.

• Protected internal APIs using tokens.

• PII truncation/redaction in log previews.

3. DATA MINIMIZATION

Advertising egress uses hashed identifiers where designed. Clear email/phone are limited to configured CRM destinations and Merchant-controlled exports where the applicable consent/privacy state permits.

AI features are designed not to receive end-customer personal data. Merchant-provided free text is forwarded as typed and could contain personal data if the Merchant enters it.

4. DISASTER RECOVERY

Cloudflare D1 currently has point-in-time recovery retention of up to 30 days on the applicable paid Workers configuration. Durable Objects recovery is expected to be approximately 30 days, subject to technical verification. Cloudflare KV has no backup copy.

Supabase currently operates on a Free configuration without automatic backups. A future Pro configuration may retain daily database backups for up to 7 days.

5. SECURITY CLAIMS

SetRoasFlow does not currently claim SOC 2, ISO 27001 or other security certification.

[ENGINEERING REVIEW REQUIRED: document verified monitoring, vulnerability management, incident response, access-review and disaster-recovery controls before publishing additional detailed claims.]