SECURITY & TRUST
Your store stays private. Everything we build is yours.
How we handle access to your Shopify admin, your code and your customer data — written for founders and the procurement teams who ask.
HOW CHANGES SHIP
Nothing goes live until a person says yes.
Every theme, app and checkout change is built on a duplicate, reviewed in a preview link, and published only when your team approves it.
01
Every change waits for review
Work happens on an unpublished theme duplicate or a development store. You see a preview before anything touches the live store.
02
Private until you launch
Password-protected development stores, unlisted previews and staging on GitHub. Nothing is indexed, shared or public until launch day.
03
Named, separate access
We request Shopify collaborator access with only the permissions the work needs — themes, apps, products — never payments or billing unless agreed.
04
Access removed when work ends
Collaborator access, app API keys and repo seats are revoked at handover. You get a written list of what was removed.
05
Yours on the final payment
Theme code, custom apps, Figma files and documentation transfer to you on the final invoice. No licences held back, no lock-in.
06
One senior point of contact
A single lead owns the project, the access list and the audit trail of who changed what, and when.
COMPLIANCE
Not certified ourselves. We work to your vendor rules.
Creative Labs is a small senior team, not a SOC 2 audited vendor. Shopify carries PCI DSS Level 1 for payments; we fit into the controls you already run.
Your accounts, your controls
The store, domains, apps and analytics stay in accounts you own. We never create a store, Klaviyo or Google account on your behalf without putting you as owner.
Least access, removed at the end
Collaborator requests scoped to the task. Shared credentials are never used; every person has their own login with 2FA.
NDA and DPA
We sign your mutual NDA or provide ours. A Data Processing Agreement is available for any work that touches customer records.
Security questionnaires
Send your vendor questionnaire. We answer it ourselves, honestly, including the parts where the answer is “not applicable to a team of our size”.
AI under your rules
We use AI tools to draft code and copy. Customer data is never pasted into third-party models. If your policy says no AI, we work without it.
GDPR, CCPA and VCDPA
Cookie consent, data requests and privacy policy copy are built to the regimes your customers live under — EU, UK, California and Virginia first.
Accessibility
Builds target WCAG 2.1 AA: contrast, focus states, keyboard navigation and alt text are part of QA, not an add-on.
PCI stays with Shopify
We never touch card data. Checkout runs on Shopify’s PCI DSS Level 1 infrastructure; customisations use Checkout Extensibility, not scripts.
Backups before every change
Theme backups and product/customer exports are taken before migrations and major releases, and kept until you confirm the result.
AI AND AUTOMATION
Agents draft. People approve what ships.
Our AI workflows propose theme code, copy and product data. A senior reviews every diff before it reaches your store — the same way a pull request works.
DRAFT
AI proposes
Theme sections, Liquid, metafield mappings and copy variants are drafted by agents working from your brief and brand rules.
REVIEW
A senior checks
Every change is read, tested on a duplicate theme and run through Lighthouse and accessibility checks before approval.
SHIP
You publish
Nothing is published to a live store by an agent. The publish step is a person on your team or ours, on your say-so.
OWNERSHIP
Paid for means handed over.
On the final payment you receive everything the project produced, in accounts you control.
THEME CODE
CUSTOM APPS
DESIGN FILES
CONTENT & DATA
DOCUMENTATION
ACCESS LIST
TOOLS
Where your files and messages live.
Every tool we use is a mainstream vendor with its own published security documentation.
Shopify
Collaborator access via Shopify Partners. PCI DSS Level 1, SOC 2 Type II.
GitHub
Private repositories in our organisation during the build, transferred to yours at handover.
Figma
Design files in a project you can see from day one. SOC 2 Type II.
Google Workspace
Email and documents. 2FA enforced on every account.
Slack or email
A shared channel in your workspace or ours. We join yours if you prefer.
Klaviyo or Spoks
Email and SMS platforms stay in your account; we work as an invited user.
FOR PROCUREMENT
The short version for your procurement team.
LEGAL ENTITY
CERTIFICATIONS
DATA HANDLING
CONTRACTS
INSURANCE
CONTACT
PROCUREMENT
6 questions
Do you need admin access to our store?
No. We request collaborator access through Shopify Partners with only the permissions the scope needs. Billing, payments and staff management stay off unless you add them.
Will you sign our NDA and DPA?
Yes, we're happy to review and sign your NDA, and to work through a data processing agreement where your project involves customer data. Send them over with your brief.
Are you SOC 2 or ISO 27001 certified?
Ask us for our current security documentation and we'll tell you plainly what we do and don't hold. Our controls are practical: least-privilege collaborator access, private previews, and access revoked at handover.
Who owns the code and designs?
You do. Theme code, custom apps, Figma files and documentation transfer to you on the final invoice, with no licences held back and no lock-in.
Do you use AI on our project?
Yes, as a tool, with people directing it and reviewing every change. We don't put your customer data into AI tools, and nothing ships without a senior's review.
Can you complete our vendor questionnaire?
Yes. Send it over and we'll complete it, including how we handle access, previews and data. Most answers are on this page already.
You've reached the end, so now…
Tell us what you're selling.
Send us your store. Within one business day you get a short Loom from a senior: the three things we'd fix first, what it would cost, and whether we're the right team for it.
- No pitch deck, no discovery-call theatre
- You keep the audit whether or not you hire us
- Fixed-scope quotes, no hourly surprises
Prefer to talk? Book 20 minutes with Haniel or call +1 855-764-4977