Security at GrowingWhale

Version 2.0 · Effective October 2, 2026 · Last updated October 2, 2026

Shopinzip Inc protects Member data with layered safeguards. This page summarizes our practices. It is informational and creates no warranty; our commitments are in the Terms of Service and the Data Processing Addendum.

How we approach security

We use administrative, technical and physical safeguards designed to protect Member data, appropriate to the nature of the data and the risks. They include measures such as:

• encryption of data in transit and at rest;
• protection of OAuth tokens, API keys and secrets;
• role-based, least-privilege access and strong authentication for staff;
• logical separation of each Member's data;
• requesting only the Google, Meta and other permissions each feature needs;
• logging, monitoring and rate limiting across the app, APIs and MCP server;
• backups and the ability to restore data;
• secure development practices and review of the vendors we use (see our subprocessor list);
• confidentiality obligations for staff and removal of access when they leave.

We review and update these measures over time. No system is completely secure, and we can't guarantee that data will never be accessed, disclosed, altered or lost. We don't currently hold SOC 2 or ISO 27001 certification.

Where data lives

Member data is stored with our cloud hosting providers in the United States or the other locations named in our subprocessor list. Our teams in the United States and India (Shopinzip Pvt Ltd) may access it to support and operate the Service, under the safeguards in our DPA.

Incidents

We follow an incident response procedure. If we become aware of a breach affecting a Member's personal data, we notify that Member without undue delay and as the law and our DPA require.

Your part

• Use strong, unique passwords and turn on multi-factor authentication.
• Give team members only the roles they need, and remove them when they leave.
• Review connected apps and AI clients, and revoke the ones you don't use.
• Keep confirmations on for AI and automation actions that touch live customers.

Report a vulnerability

Email security@growingwhale.com with the subject "Security Report," including steps to reproduce. Our security.txt file is at growingwhale.ai/.well-known/security.txt. We aim to acknowledge reports promptly.

In scope: systems we operate on growingwhale.ai, growingwhale.app and their subdomains, including the Studio app, APIs and the MCP server.

Out of scope: third-party services such as Google, Meta, Microsoft, Anthropic and Stripe (report to them directly); content Members publish; denial of service; spam; social engineering; and physical attacks.

Rules:

• Access only the minimum data needed to show the issue, then stop and report it. Never access, change or keep other Members' data.
• Don't degrade the Service.
• Give us 90 days to fix the issue before disclosing it.

Safe harbor. If you follow these rules in good faith, we won't take legal action against you or report you to law enforcement, and we consider your research authorized to the extent we can authorize it.

We don't run a paid bug bounty, but we're glad to thank researchers publicly with their permission.