Skip to content

Security

Last reviewed November 3, 2026

At a glance

  • Read-only. TagGap never creates, edits, pauses or deletes anything in your store or your ad accounts, and it adds nothing to your storefront or checkout.
  • Minimal access. Each connection asks for the narrowest permission that lets TagGap read the numbers it compares.
  • Encrypted credentials. Every access token is encrypted with its own key before it is stored.
  • Your data, deletable. Disconnect a platform or uninstall the app and the related data is deleted.

What TagGap can access

  • Shopify: read_orders only, with Level 1 protected customer data. No customer scopes and no access to orders older than 60 days.
  • Google Analytics 4: analytics.readonly, read-only access to the property you choose.
  • Meta: ads_read, read-only access to the ad account you choose.
  • Google Ads and TikTok (when available on your plan): Google's Ads API has a single permission, which TagGap uses only to read conversion reports; TikTok access is limited to listing your ad accounts and reading reports.

Each platform is connected separately, by you, and can be disconnected at any time from Apps → TagGap → Destinations.

How we protect it

  • Access tokens are envelope-encrypted: each one is sealed with its own random 256-bit key (XChaCha20-Poly1305), and that key is itself encrypted under a master key that never sits in the database. Deleting a token's record destroys the only copy of its key.
  • The app secrets for Google, Meta and TikTok are not stored on TagGap's application servers. Token exchanges go through a separate gateway that holds them, so a compromise of the app servers would not expose them.
  • Every request from the TagGap app in Shopify admin carries a session token signed by Shopify, which we verify. Every webhook from Shopify is checked against its HMAC signature and rejected if it doesn't match.
  • All traffic uses TLS. Server administration requires Cloudflare Access; it is not open to the internet.

Where it runs

TagGap runs on Akamai Cloud (Linode) in the United States, whose infrastructure is covered by a SOC 2 Type II report. Cloudflare provides DNS, TLS and network ingress. The full list of providers that process data for TagGap is on the subprocessors page.

TagGap itself does not yet hold a SOC 2 report of its own. If your security review needs one, tell us; we'll answer your questionnaire in the meantime.

Retention and deletion

Disconnecting a platform deletes its access token at once. Uninstalling TagGap deletes all access tokens immediately, and the remaining data for the store is deleted when Shopify sends its deletion request 48 hours later. Details are on the data deletion page and in our privacy policy and DPA.

Health data

TagGap is not designed to process protected health information, and we do not sign HIPAA business associate agreements. Shopify itself does not permit PHI on its platform.

Report a vulnerability or request a review

Email hello@taggap.com with "Security" in the subject to report a suspected vulnerability or to send a security questionnaire. Please give us a reasonable chance to fix a reported issue before disclosing it publicly. We aim to reply within two business days.

Operator

Wells Software Consulting LLC, 1 E Erie St, Suite 525-2098, Chicago, IL 60611, United States.