Simple Bundles security center: status updates and how we protect your store

This page lists security issues affecting Shopify apps and merchants, whether Simple Bundles is affected, and what you need to do, if anything. We add a new entry whenever a widely reported issue comes up.

Last reviewed: October 22, 2026

Security status updates

How does Simple Bundles protect my store?

• Simple Bundles connects to your store only through Shopify's official APIs and asks only for the permissions its features need.
• Customer data permission is requested only when you turn on a feature that needs it. See Understanding customer data permissions in Simple Bundles.
• The app does not inject scripts from its own database into your storefront. Any custom code on your storefront lives in your Shopify theme, which only you and the people you approve can edit.
• The access tokens the app uses to connect to your store expire after a short time, which limits what anyone could do with a stolen token.
• Team members who work on Simple Bundles use multi-factor authentication.

Why does support sometimes ask for access to my store?

We solve most questions without store access. When we do need it, we explain why and which permissions we need. Why Simple Bundles support may ask for access to your store lists each permission and what we use it for, and shows how to remove our access afterwards.

Can I get a security questionnaire or subprocessor list?

Yes. Email hello@simplebundles.io from your company email address and tell us what your review needs. Our team will follow up directly.

How do I report a security concern?

If you see something on your storefront or in your Shopify admin that you think is related to Simple Bundles, email hello@simplebundles.io with screenshots and your store's myshopify.com URL. Security reports go straight to our development team.