Security & privacy
How we protect your store data
Avada PDF Invoice reads your orders to print invoices, so your store data passes through our systems. Below is where it runs and who else gets to see it.
Last checked against the app's code on 4 November 2026.
What protects your data today
Hosted on Google Cloud
Backend, database and file storage all run on Google Cloud in the United States, through Firebase. There is no second hosting provider.
Encrypted in transit
Every connection uses HTTPS, from the admin inside Shopify to the invoice link your customer clicks.
Encrypted at rest
Google Cloud encrypts stored data by default. Your store’s Shopify access token is encrypted a second time by the app before it is saved.
Database closed to browsers
A browser can’t read or write our database. Only our backend gets in.
Shopify webhooks are verified
Shopify signs each order update it sends us. No valid signature, no action.
PDFs are made in-house
We render every document inside our own Google Cloud setup, so your orders never go to an outside PDF service.
Signed customer links
Invoice links emailed since 14 October 2026 are signed and expire after 90 days.
No PHP anywhere
The backend is Node.js and there is no PHP in the codebase. PHP2Shell doesn’t apply.
Read more
Sub-processors
Services that process data for the app
Each one gets only the data listed next to it.
| Service | What it does | Data it receives | Country |
|---|---|---|---|
| Google Cloud Platform (Firebase) | Hosting, database, file storage, PDF rendering and our internal analytics warehouse | All app data | United States |
| Mailgun | Sends invoice emails to your customers, unless you connect your own SMTP server | Customer email address and the document | United States |
| Amazon SES | Sends invoice emails for some stores, in place of Mailgun | Customer email address and the document | United States |
| Google Cloud Translation | Translates product names, only if you turn this on | Product titles only | United States |
| Anthropic (Claude) | Write with AI: drafts legal text on your template, only when you use it | What you type and your business details, never orders or your customers’ data | United States |
| Crisp | Support chat inside the app | Shop name, URL and email, owner name, plan | France |
| Microsoft Clarity | Usage analytics for the app admin | Shop domain and how staff use the admin | United States |
| Freshpaint | Product analytics for the app admin | Shop domain, email, name and plan | United States |
Only if you turn them on
Avada Email Marketing
Another Avada app. It gets data only after you connect the two apps with an API key, and then receives order details and your customer’s contact details for email marketing.
Google Drive, FTP or SFTP
Only if you set up automatic delivery of invoices to a folder or server you choose.
Your own SMTP server
Only if you send invoice emails through your own mail server instead of ours.
Langshop appears in our “works with” list because both apps can run on the same store. The two apps are not connected, and Langshop receives no data from us.
Running a vendor review?
Send the questionnaire your company uses. We reply in writing, point by point, after checking each answer against the app's code.
Email [email protected]Put “Security” in the subject so it reaches the right people.
Frequently asked questions
Where is my store data hosted?
On Google Cloud in the United States, through Firebase. We don’t use any other host.
Is my data encrypted?
Yes. Connections use HTTPS and Google Cloud encrypts what it stores. On top of that, the app encrypts your Shopify access token before saving it.
Does a third-party service create my PDFs?
No. We render them ourselves, inside our Google Cloud environment.
My company is running a vendor review. Who do I contact?
Email [email protected] with “Security” in the subject, or open the chat in the app. Send the questionnaire your company uses and we will answer every point in writing.