Bunyawi

Security and data protection

Last updated 9 October 2026 · Bunyawi, Cairo, Egypt · Security reports and questions: privacy@bunyawi.com

This page describes what is actually in place for Bunyawi Apps, Tarteeb and Tasleem. It is written as a list of facts, not promises, and it is updated when the facts change. The privacy policy says what we collect and why; the data processing terms say what we owe a merchant as their processor.

1. Where it runs

  • The platform runs on a single DigitalOcean droplet in Frankfurt, Germany (EU region fra1), with Cloudflare in front of it.
  • TLS everywhere: Cloudflare terminates TLS at the edge, and the connection from Cloudflare to the origin server is itself TLS with a Let's Encrypt certificate. There is no plain-HTTP path to the APIs.
  • Tarteeb runs as its own service, with its own database, separate from Bunyawi Apps. Its panel lives on its own address, ops.bunyawi.com. The service listens only inside the server, and only Cloudflare's network can reach the ops.bunyawi.com site on it.
  • The PostgreSQL databases listen on localhost only. They are not reachable from the internet, and there is no public database port.
  • Each merchant's data is isolated inside the database with PostgreSQL row-level security keyed by tenant id. A query made in one merchant's context cannot return another merchant's rows, even if the application code had a bug. In Tarteeb the application's database role cannot bypass that rule and cannot change the database's structure.

2. What we process

Bunyawi Apps processes only what a merchant's app needs to work:

  • Orders: order number, items, totals, status.
  • Customer name, email, phone and shipping address — only when Shopify has granted the merchant's installation that access (Shopify's protected customer data approval).
  • Push notification tokens, so order updates can be delivered to the device.
  • Sign-in identity through Firebase Auth (a user id and the email or provider it is linked to).

Tarteeb and Tasleem process the merchant's orders from Shopify, the WhatsApp messages and courier data around them, the merchant's team accounts, Tasleem devices and the Print Helper's printers — the full list is in the privacy policy.

We never receive or store card data. Payment happens in Shopify's checkout or through the merchant's own payment gateway; card numbers do not pass through Bunyawi.

3. How long we keep it

Bunyawi Apps

  • Orders: kept for as long as the merchant has the app installed — they are the merchant's tax and commercial records.
  • A customer's name, email and phone: erased from their orders when Shopify sends customers/redact, or when the customer deletes their account in the app. The order itself remains, without the person.
  • Raw webhook payloads: 90 days.
  • Abandoned app carts: 30 days.
  • Checkout requests: 90 days.
  • Audit and access logs: 365 days.
  • An uninstalled store: everything is deleted 30 days after uninstall — or immediately when Shopify sends shop/redact.

Tarteeb and Tasleem

  • Sign-in and verification codes: 1 day.
  • Expired sessions and device tokens: 30 days.
  • Raw webhook payloads: 90 days.
  • Label and packing-slip files, and return photos: 30 days.
  • Audit log: 1 year.
  • A deleted business: everything is deleted within 30 days of the owner's request.

Encrypted database backups of both are kept for 14 days.

4. Encryption

  • In transit: TLS on every hop, as described above.
  • At rest: the PostgreSQL data directory lives on a DigitalOcean Block Storage volume, which is encrypted at rest at the storage layer (LUKS). The volume is attached only to this one server.
  • Backups: the databases are backed up nightly. Each backup is encrypted with AES-256 (GnuPG) before it is written to disk, and the key is held only by the operator. A backup that cannot be decrypted and restored is discarded.
  • Merchant credentials in Tarteeb — Shopify, courier, WhatsApp and Gmail keys and tokens — are encrypted with AES-256-GCM, each one bound to its business, and are never shown back in full. The master key is not in the database.
  • Server secrets — database credentials, API keys, signing keys and Tarteeb's master keys — live in files on the server readable only by root and the service that uses them. They are never committed to the code repository and never written to a log.

5. Accounts and sign-in (Tarteeb and Tasleem)

  • Passwords are 12 to 128 characters, with no forced symbols and no forced expiry. Common passwords, and passwords that contain the username or the business name, are refused; passwords are also checked against known breached passwords with a privacy-preserving lookup that sends out only the first five characters of the password's hash.
  • Passwords are stored with Argon2id. Nobody at Bunyawi can see them.
  • Every sign-in to the Tarteeb panel also needs a 6-character code sent to the account's email. A code works once, for 10 minutes, and five wrong tries cancel it.
  • Anyone with a panel account can add an authenticator app; for Bunyawi's own admin console it is required.
  • Sessions end after 60 minutes of inactivity and after 12 hours in any case. Each person can see their sessions and sign them out in Settings → Security; changing a password signs out every other session.
  • Changing courier, Shopify or WhatsApp credentials, team roles, or an email address or password needs the password again.
  • Repeated failed sign-ins are slowed down and then locked, without revealing whether the account exists.
  • Tasleem: by default, a new phone works only after an owner or admin approves it. It receives short-lived access tokens, refreshed with single-use tokens; reusing an old one signs the phone out. Tokens are kept in the phone's secure storage.
  • The Print Helper pairs with a single-use 8-character code that expires after 10 minutes. It can be removed at any time in Settings → Printing.

6. Who has access

  • Bunyawi is run by one operator. There is no support team with production access.
  • Administrative access to the server is limited to the operator.
  • Bunyawi Apps merchants reach their dashboard only through Shopify's own staff login and session tokens. We never see or store a merchant's password.
  • Bunyawi Apps shoppers sign in through Firebase Auth: Google, Apple, or email with verification. We do not store shoppers' passwords.
  • The operator's own accounts — GitHub, Google, DigitalOcean, Cloudflare, Shopify Partners — use unique passwords of 16 characters or more from a password manager, plus two-factor authentication.
  • In Bunyawi Apps, every change made in the dashboard, and every read of customer personal data, is written to a per-merchant audit log that the merchant can view.
  • In Tarteeb, sign-ins, failed sign-ins, codes sent, password and authenticator changes, session revokes, settings and credential changes, team changes, device approvals, cancellations and exports are written to an audit log that the application can add to but not change. Each person can see their own recent activity.

7. Test data and production

  • Test orders in Bunyawi Apps are in-memory fixtures. They are never written to the database, and they are shown only to allow-listed test accounts.
  • Tarteeb has a demo business with a simulated courier, used for app-store review and testing. It never books a real parcel.
  • Development runs against local data on the developer's machine, and automated tests use a throwaway database — never the production database.

8. If something goes wrong

  1. Contain — rotate the affected secret and block the source at Cloudflare.
  2. Assess — establish the scope from the server logs and the audit log: which merchants, which data, which period.
  3. Notify — email every affected merchant within 72 hours with what happened and what data was involved, and notify Shopify where its terms require it.
  4. Fix — correct the root cause and redeploy.
  5. Learn — write a post-mortem and make the change that stops it recurring.

To report a vulnerability or a suspected incident, write to privacy@bunyawi.com. Reports are read by the operator personally.

9. Data subject requests

  • A Bunyawi Apps customer can delete their account from inside the app. Their name, email and phone are removed from their orders at that moment.
  • A Tasleem user can delete their account from inside the app, in Settings → Delete my account. What happens then.
  • A merchant who receives a request from a customer forwards it to privacy@bunyawi.com.
  • Shopify's customers/data_request, customers/redact and shop/redact webhooks are implemented for Bunyawi Apps and honoured automatically.

10. Sub-processors

The third parties that necessarily handle some of this data, and what for:

  • DigitalOcean — hosting (Frankfurt).
  • Cloudflare — DNS, CDN, TLS termination and email routing.
  • Brevo — sends Tarteeb's sign-in codes and account emails.
  • Google — Gmail's mail servers send those emails when Brevo cannot.
  • Google Firebase — Bunyawi Apps: customer authentication, push delivery (Android, and iPhone until the merchant uploads an Apple push key), crash reporting and usage statistics.
  • Apple — Bunyawi Apps: iOS push delivery (Apple Push Notification service).
  • Google Play — Android app distribution and device services.
  • GitHub — code hosting and the build pipeline.
  • Codemagic — Bunyawi Apps: iOS builds; sees the merchant's App Store Connect key for the duration of a build.
  • Google (Gemini) — Tarteeb: reads a delivery address, or the words of a customer's WhatsApp messages, when the word matcher cannot place them; what is sent is set out in the privacy policy.
  • Telegram — Bunyawi Apps: the operator's alert when a store asks to publish; it carries the store's name and Shopify domain, nothing about customers.

Shopify, Meta (WhatsApp), Fincart, Bosta and — for Bosta complaints — the merchant's own Gmail are services the merchant connects with their own accounts; they are listed in the privacy policy. If the list of sub-processors changes, merchants are emailed before the change takes effect.