Skip to content
CanShip

Security & Compliance

Built secure. Built Canadian. Built to be auditable.

CanShip handles your inventory data, your customer addresses, your shipping records, and your billing information. We treat all of it like it's our own.

Where your data lives

CanShip runs entirely in Montreal, Canada. Every database, every backup, every audit log. Your data does not flow through US infrastructure for normal operation. Customers who need the specifics of our hosting can request them under NDA.

Limited, disclosed exceptions:

  • Payment processing is handled by Stripe Inc. Cardholder data flows through Stripe's PCI-DSS Level 1 compliant infrastructure. Operational data (orders, inventory, customers, shipping records) does not.
  • Transactional email. Email metadata may transit infrastructure outside Canada in the normal course of delivery.
  • US import duty prepayment for Canada Post-to-US shipments uses Zonos. Customs declarations and recipient data are sent to Zonos solely for duty calculation.

Encryption

  • In transit: TLS 1.2+ enforced across the entire platform. Older TLS versions are rejected.
  • At rest: AES-256 via AWS KMS (Key Management Service).
  • Backups: Encrypted at rest, inheriting the database cluster's KMS key, retained 7 days (Aurora point-in-time recovery).
  • Attachments: Receiving and damage photographs are stored in Amazon S3 under a customer-managed KMS key with automatic annual rotation enabled.
  • Sales-channel and carrier credentials: Encrypted with AWS KMS envelope encryption with a separate sidecar metadata column.

Network security

  • AWS WAF v2 sitting in front of CloudFront, with managed rule sets (IP reputation, OWASP, known-bad inputs) and documented rollback paths.
  • CloudFront for distribution and DDoS resistance.
  • Per-route API rate limiting to mitigate abuse and accidental flooding.
  • Carrier API throttling to prevent rate-limit accidents that could block your shipments.

Application security

  • Cross-tenant query gate static check, currently passing with zero violations across 292 scanned files. We look for tenant data leaks at build time rather than waiting for a customer to report one.
  • AWS Cognito for authentication, with role-based access control. Refresh tokens stored in HttpOnly cookies, not accessible to client-side JavaScript.
  • Three full rounds of penetration testing completed and remediated, including patches for an authentication bypass, IAM role privilege separation, and TLS bundle correctness.
  • Dependabot monitoring third-party libraries for known CVEs, with automated PRs for patches.
  • Secrets management via AWS Secrets Manager. No credentials in code, no .env files in production.

Identity and access

  • Role-based access control: Member for day-to-day warehouse work, Admin for account-level settings such as warehouses, locations, carriers and user management, and Customer for a client-portal login that sees only that client's own stock, orders and shipments. Super Admin is a separate elevated grant rather than an invite option.
  • Session timeout: Automatic logout after configurable inactivity period.
  • Strong password requirements for staff accounts: minimum length and complexity. We do not force password expiry, which pushes people toward weaker passwords they can remember.
  • Multi-factor authentication (MFA) is required for admin users and available to staff and client users.

Compliance

  • PIPEDA (Personal Information Protection and Electronic Documents Act): CanShip is operated by My Passion Media Inc., a British Columbia corporation, and operates entirely under PIPEDA. Pro and Enterprise plans include our PIPEDA documentation: Data Subject Access Request handling, breach notification process, and our sub-processor list.
  • SOC 2: Phase 2 readiness in progress. Type I audit targeted for late 2026 / early 2027.

Audit trail at the data layer

  • Every movement of inventory (stock, allocations, and holds) is logged at the database layer via PostgreSQL triggers, with actor identifier, timestamp, source type, and source identifier, and quantities before and after.
  • Static-analysis gate in CI blocks a merge or a deploy when a backend query against a tenant-scoped table is missing its tenant predicate. It runs on every pull request and every release, and last scanned 292 files with zero violations. It is a static check with documented, annotated exceptions, not a formal proof.
  • Immutable retention: Audit logs cannot be edited or deleted, only appended.
  • Customer access: Pro and Enterprise customers can view their own audit log via the admin dashboard.
  • CloudTrail at the infrastructure level for all AWS actions.

Environment separation

  • Test, sandbox, and production environments are strictly isolated. Sandbox tenants run on the same infrastructure but are flagged at the database row level, with UI banners and tenancy enforcement.
  • Production personal data does not flow into development or sandbox environments. Sandbox seed data is synthetic.

Data loss prevention

  • Security pipeline on every pull request and every deploy includes secret scanning (TruffleHog), dependency vulnerability scanning (npm audit), and static-analysis security testing (Semgrep). Because the scanners run on pull requests as well as releases, a finding blocks the merge rather than only the deployment. The scanning actions are pinned to specific commit SHAs rather than floating tags.
  • Required human approval before production. Backend and frontend deployments each halt at a protected environment gate and will not proceed without a named reviewer approving the release.
  • Webhook payloads carrying personal data (Shopify webhooks, carrier webhooks) are purged on a 90-day retention window. Purged payloads are stamped as erased, so a deleted payload is distinguishable from one that arrived empty.

Shopify Protected Customer Data

Fulfillment requires customer name, shipping address, phone, and email, which Shopify classifies as Protected Customer Data. CanShip's Shopify integration is built to meet Shopify's Protected Customer Data requirements at Level 1 and Level 2.

  • Minimum data principle: we request only the OAuth scopes required for fulfillment.
  • No data sale, no cross-context behavioural advertising: Shopify customer data is used for fulfillment only. We do not sell, rent, or share it for advertising or marketing purposes.
  • Encryption: customer data is encrypted at rest and in transit. Attachments are encrypted under a customer-managed KMS key with automatic annual rotation. Database backups inherit the cluster's encryption key.
  • Environment separation: production personal data does not flow into development or sandbox environments. Sandbox seed data is synthetic.
  • Mandatory compliance webhooks. The CanShip Shopify app subscribes all three topics, customers/data_request, customers/redact and shop/redact. They are delivered to an endpoint that validates Shopify's HMAC signature and rejects anything that fails it. Stores connected through a per-store custom app are exempt from the requirement and cannot subscribe these topics, so requests for those stores reach us through the merchant and are handled by the same process.
  • What each topic does. customers/redact and shop/redact erase ship-to personal data, scoped to the store that asked. An erasure that does not complete in full is recorded as an error and stays open until it does. We do not report a completed erasure we did not complete. customers/data_request is deliberately handled by a person rather than automatically, because Shopify directs the merchant, not the app, to answer their shopper. It is surfaced to an operator with the 30-day response window stated.
  • Uninstall and reinstall: shop/redact fires 48 hours after an uninstall. If the store has reconnected by then, the redaction is skipped, so a merchant who reinstalls inside the window does not lose live shipping addresses.
  • Audit log: inventory movements (stock, allocations, and holds) are logged at the database layer with actor, timestamp, source, and quantities before and after.
  • Staff access: limited to personnel whose roles require it, with named-user authentication. Administrative access to production infrastructure requires multi-factor authentication.
  • Incident response: a documented policy with severity classifications, escalation paths, and notification timelines.
  • Data Processing Agreement (DPA): available on request from legal@canship.co.

Full details in our Privacy Policy, Section 11.

Incident response

  • 24/7 monitoring with automated alerts on anomalous activity.
  • Documented security incident response policy with severity classifications, escalation paths, and notification timelines.
  • Breach notification commitment: If a security incident affects your data, you'll hear from us within 72 hours of confirmation, in compliance with PIPEDA's Office of the Privacy Commissioner notification requirements. For Shopify merchants, breach notification follows Shopify's API Terms of Service and Partner Program Agreement.
  • Public status page: status.canship.co, real-time uptime, incidents, and scheduled maintenance.

Reporting a vulnerability

If you've found a security issue in CanShip, please email security@canship.co with details. We treat security reports with priority and will respond within one business day.

We are not running a formal bug bounty program yet, but we acknowledge responsible disclosure publicly (with permission) and recognize researchers who help us improve.

Compliance and certifications summary

Item Status
PIPEDA (Canadian privacy) Compliant. Documentation pack on Pro+ tier.
Shopify Protected Customer Data Level 2 Controls in place and documented against Shopify's Level 2 requirements.
TLS 1.2+ enforcement Live
Canadian data residency (Montreal) Live
WAF + CloudFront protection Live
Penetration testing 3 rounds completed and remediated
Cross-tenant query gate Zero violations
KMS encryption at rest Live
Audit trail at the database layer Live (PostgreSQL triggers)
Public status page Live at status.canship.co
MFA for admin users Live, required
SOC 2 Type I Planned (readiness in progress)
Bug bounty program Planned (Phase 3)

Documentation available on request

For Pro and Enterprise customers, the following documentation can be provided under NDA:

  • Data flow documentation, including how personal data moves through the system
  • Sub-processor list
  • Incident response plan
  • Penetration testing scope and remediation summary
  • Hosting and infrastructure detail

Request via security@canship.co. We respond within one business day.

Have specific security questions?

We get this question a lot, especially from larger 3PLs and brands with their own compliance obligations. We're happy to walk through our architecture, answer specifics, or fill out your security questionnaire.

Talk to security or book a demo.