App Attic

Cyber/Legal documents

What we sign before any cyber work starts

Testing a system without authorization is a crime in the UK, the EU and the US, whatever the intent. Testing with vague authorization is how disputes start. So before any red team or blue team activity, we put the documents below in place with every client: a Shopify Plus store, an agency, a theme developer or an app developer.

We bring the templates. Your counsel reviews them. Nothing is touched until the set is signed. The terms these documents implement are on the terms of engagement page.

Last updated October 22, 2026

  1. 1.Mutual non-disclosure agreement

    Covers everything either side learns during the engagement: your architecture, credentials, customer data and findings on your side; our methods and tooling on ours. Survives the end of the engagement.

    Who signs
    App Attic Ltd and the client
    When
    First, before the scoping conversation gets specific

  2. 2.Statement of work

    The commercial document. It must contain:

    • The service: red team, blue team, theme review, app review, or a combination
    • The scope schedule: every store domain, theme ID, app handle, endpoint, repository, account type and integration in scope, and an explicit out-of-scope list
    • The testing window, time zone, retest period and report retention period
    • Named contacts on both sides, including the emergency contact who can halt testing
    • Fees, payment terms, the liability cap and the insurance cover amount
    Who signs
    App Attic Ltd and the client
    When
    After the intro call, before the letter of authorization

  3. 3.Letter of authorization

    The document that makes the testing lawful. It states that the signer owns or controls the assets in the scope schedule and authorizes App Attic to test them, within the rules of engagement, during the window. It must contain:

    • The legal name of the authorizing entity and the name and role of the signer, who must have authority to grant it
    • A reference to the exact scope schedule and the dates
    • The declared source IP addresses we will test from
    • Confirmation that the signer's Shopify agreement and any hosting or SaaS terms permit the testing

    Agencies: one letter from the agency for its own systems, plus one from each merchant whose store is in scope. We don't accept an agency's word on a merchant's behalf. Theme and app developers: the letter covers your own code, infrastructure and development stores. Merchants who installed your product are never in scope.

    Who signs
    The asset owner: merchant, agency, developer, and each merchant an agency brings
    When
    Before the window opens. No letter, no testing.

  4. 4.Rules of engagement

    The operational rules for the window, attached to the statement of work:

    • Allowed and prohibited techniques, including an explicit yes or no on social engineering of your staff, with a named sponsor if yes
    • Testing hours, blackout dates (sales, launches, deploys) and the communication channel
    • Stop conditions and the halt procedure on both sides, with response times
    • What happens if we find evidence of a real intrusion: who is told, within what time, and whether testing pauses
    • Which environment is tested first where a staging or development store exists
    Who signs
    Both technical leads
    When
    With the statement of work

  5. 5.Data processing agreement

    Required whenever testing may touch personal data, which on a live store means always. Under UK GDPR you are the controller and App Attic the processor. It sets out what data we may process, for what purpose, where it is stored, who at App Attic can see it, the sub-processors (none by default), the retention and deletion schedule, and the breach notification duty.

    Who signs
    App Attic Ltd and the controller
    When
    Before the window opens

  6. 6.Access record

    A log of every account and permission granted to App Attic: Shopify collaborator or staff account, the permission set, repository or cloud access, API tokens, with the grant date and the revocation date. Signed off by you at the end, so there's no doubt everything was closed.

    Who signs
    The client's admin owner, countersigned by App Attic
    When
    Grants at the start, revocations at the end

  7. 7.Shopify terms acknowledgement

    A short joint statement, attached to the letter of authorization:

    • The engagement tests the client's assets within Shopify's Terms of Service and Acceptable Use Policy
    • Shopify's own platform is out of scope; any suspected Shopify flaw is reported to Shopify through its HackerOne program under that program's rules, and the client is told
    • No denial of service, and no social engineering of Shopify staff or support, under any circumstances
    • Flaws in third-party apps or themes are disclosed to their developers first
    Who signs
    App Attic Ltd and the client
    When
    With the letter of authorization

  8. 8.Closing letter and deletion certificate

    Issued after the retest. It lists what was found, what was fixed and verified, what you chose to accept, confirms that all access was revoked and that our working copies of your data were deleted on the agreed date. It's the document you show an auditor, an insurer or a Shopify Plus account manager.

    Who signs
    App Attic Ltd, acknowledged by the client
    When
    After the retest