Security at GrowingWhale

Shopinzip Inc protects Member data with layered safeguards. This page summarizes our practices. It is informational and does not create any warranty. Our commitments are set out in the Terms and DPA.

Our practices

• Encryption: TLS 1.2+ in transit, and AES-256 at rest for databases, backups and secrets.
• Credentials: OAuth tokens and API keys are encrypted and scoped per Member, and are never exposed in the browser.
• Access control: least privilege, MFA for staff, and prompt revocation of access.
• Isolation: each Member's data is logically separated.
• Least-privilege scopes: we request only the Google, Meta and other permissions each feature needs.
• Monitoring: logging, alerting and rate limiting across the app, APIs and MCP server.
• Resilience: automated backups with a 35-day retention and a tested restore process.
• Vendors: we use reputable subprocessors with strong security programs (list).
• Incident response: a documented plan with Member notification within 72 hours of confirming a breach affecting their data.

Your part

• Use strong unique passwords and enable MFA.
• Give team members only the roles they need.
• Review connected apps and revoke the ones you don't use.
• Review AI and automation actions before they touch live customers.

Report a vulnerability

Email hello@growingwhale.com with the subject "Security Report". Include steps to reproduce. Please give us reasonable time to fix the issue before disclosing it. Do not access other Members' data, degrade service, or use social engineering. We will not pursue good-faith researchers who follow these rules.