Security overview

Lyrakart Customer Mobile App · Last updated: 30 October 2026

This page lists the measures built into Lyrakart to protect merchant and shopper data, on every store platform we support, and says plainly what is not protected yet. It supports our Data Processing Addendum. We have no third-party audit or certification.

Where data lives

Lyrakart runs on a virtual private server in Delhi, India (160.250.204.8), with a hosting provider in India. It has its own system user, its own PostgreSQL database and its own Redis, separate from anything else on that server.

Encryption

In transit: the apps, the dashboard and the API are served over HTTPS (TLS). Calls we make to addresses a merchant can set, such as an Odoo site, must use HTTPS.
Credentials: store access tokens, Odoo API keys and other secrets are kept in an encrypted vault. Each value gets its own key (AES-256-GCM), which is wrapped by a master key, and is bound to its store, so it cannot be moved to another store's account. Push credentials and app signing credentials are encrypted the same way. On Shopify, the dashboard's Shopify session tokens are also encrypted (AES-256-GCM).
Shopper personal data: our software encrypts these before they are written to the database: Shopify webhook messages and privacy request messages; names, emails, phone numbers and notes in appointment bookings; contact emails and notes in quotes; names, emails and text of contact messages; newsletter emails; the reference to each prescription file; and the Odoo website session cookie we hold for each app install.
Lookups: where we must find a record by email or customer ID, we use a keyed hash, so the values cannot be searched without our key. Shopper emails in customer summaries are stored as one-way hashes.
Not yet encrypted by our software: staff names and emails; shopper community posts, live chat and assistant messages; device details and app activity; and the email and country entered for an Odoo cart.
Uploaded files (prescription files, community photos, app images) are stored on the server disk. Private files can be opened only with a signed link that expires. The files themselves are not encrypted.
The server disk itself is not encrypted. Protection of personal data at rest relies on the application-level encryption above.

Sign-in and passwords

On Shopify, merchant staff sign in through the Shopify admin.
Where staff sign in with a Lyrakart email and password, the password is stored only as a scrypt hash with a random salt. Passwords must have at least 10 characters; common passwords, one repeated character and the email address are refused.
Dashboard sessions use short-lived access tokens (15 minutes) that are renewed in the background. Removing a team member, resetting a password or signing out ends their sessions at once. The browser cookie is signed, cannot be read by page scripts (httpOnly) and is sent only over HTTPS. Forms are protected against cross-site requests.
Shopper passwords are checked by the store's platform (Shopify customer accounts, or the store's Odoo login). We do not store them.

Access control and audit

Every staff member has one role (owner, admin, designer, marketer, publisher or viewer). Each role has a fixed list of permissions, checked on every request. Reading shopper personal data needs its own permission. Sensitive actions can be set to need approval.
Changes are written to an audit log. Each staff read of shopper personal data (quotes, bookings, community and prescription queues, privacy reports, exports) writes an audit entry recording who, which records and why, before the data is returned. If the entry cannot be written, the data is not returned.
Requests from a shopping app are tied to that app's key and its store.

Abuse protection

Rate limits: sign-in, sign-up, password reset, form, deletion and other public routes are rate limited per IP address, and some also per email address.
Outbound request guard: when Lyrakart calls an address a merchant can influence, the call must use HTTPS, may not go to private, loopback or link-local addresses, does not follow redirects, has a time limit and a size limit.

Backups

The database is dumped every night at 03:30 and checked by reading the dump back. Uploaded files are archived every night at 03:15.
Both are encrypted with age before anything else happens to them. The unencrypted file is deleted right after encryption. They are kept 7 days on the server.
Each encrypted file is copied to a second server, at Contabo GmbH's EU data centre, through an account that can only write, not read or delete. Files there are kept 14 days.
The private key that opens the backups is on neither server. A restore from the off-site copy was tested on 27 October 2026.

Deletion

Shopper account deletion and Shopify privacy requests run automatically. A deletion that fails is retried, and is never reported as done when part of it failed.
Expired webhook messages, data request reports and old contact messages are deleted by a scheduled job. Details are in our privacy policy.

Personal data breaches

If we become aware of a personal data breach affecting a merchant's data, we tell the merchant without undue delay and in any case within 72 hours of becoming aware of it, as set out in our Data Processing Addendum.

Reporting a security problem

Write to info@lyrakart.com with the details. We will not take action against good-faith reports.