Security
What Siphon can see, and what it can't
Siphon reads reporting data and writes it into spreadsheets you pick. This page lists every permission it asks for, where your data lives, and who else handles it.
Plainly
Siphon is made by a small company. It is not SOC 2 audited, and we don't claim any certification.
What we can offer instead: the narrowest permissions each platform allows, this page kept accurate, and a direct line to engineering.
Permissions
Every permission we ask for
Google verified Siphon's app in September 2026, and Meta approved its app review the same month.
| Platform | Permission | Why we need it | What Siphon can't do |
|---|---|---|---|
| Google Ads | adwords | To run reporting queries on the ad accounts you choose. Google offers no read-only Google Ads permission, so this is the only one available. | Siphon's code sends reporting queries only. It never creates, edits or pauses campaigns, ads, bids or budgets. |
| Google Analytics | analytics.readonly | To read GA4 reports for the properties you choose. | Change anything in a property: read-only by Google's own definition. |
| Google Drive | drive.file | To write into the spreadsheets you pick with Google's file picker. | See, list or open any other file in your Drive. A file you didn't pick returns "not found" to Siphon. |
| Meta | ads_read | To read insights for the ad accounts you approve. | Create, edit or pause ads, or read your pages, posts or messages. |
| Shopify | read_orders | To read orders and line items from the store. Shopify limits this permission to the last 60 days of orders. | Change orders, products or settings. Shopify's screen mentions customer data; Siphon doesn't read customer names, emails, phones or addresses. |
Revoking access
You can cut Siphon off at any time
Once access is removed, imports that depend on it stop with a plain reason, such as "Your Google Ads source needs to be reconnected". Nothing more is written to your sheets.
- GoogleIn your Google Account, open Security, then "Your connections to third-party apps & services". Choose Siphon and remove its access. This covers Google Ads, Analytics and Drive at once.
- MetaIn Facebook, open Settings, then Business integrations. Find Siphon and remove it.
- ShopifyIn the store admin, open Settings, then Apps. Uninstall the Siphon app for that store.
- SiphonOn the Sources page, disconnect the source. This also deletes the imports that use it.
Your data
How it's handled
- All traffic to siphon.to is HTTPS, with HSTS.
- Platform access tokens, and each Shopify store's app secret, are stored encrypted in our database.
- Passwords are stored as hashes, never in plain text.
- Password-reset and email links work once and expire (1 hour and 24 hours). Only a hash of each link's code is stored.
- Application servers and the database run on DigitalOcean, behind Cloudflare.
- Rows go from the platform straight to your sheet. Siphon doesn't store your report rows: it keeps run counts, column names and error messages, not the data.
- The database is backed up every night and kept for 30 days.
- Restores are tested: in September 2026 a nightly backup restored cleanly, with every table's row count matching production.
- Bot checks on sign-up and password reset.
- Sign-in events are kept for 90 days with a shortened IP address, then deleted.
- Changing your password signs you out on every other device.
Subprocessors
Who else handles your data
Google, Meta and Shopify aren't on this list: they're the platforms you connect, and Siphon reads from them on your behalf.
| Company | What for | Data they handle |
|---|---|---|
| DigitalOcean | Servers, database and backups | Everything Siphon stores |
| Cloudflare | DNS, network protection, bot checks, visit statistics, support email routing | Web traffic to siphon.to; emails to [email protected] |
| Postmark | Account emails: verification, password reset and billing notices | Your email address and the email's content |
| Stripe | Subscription payments | Your billing details. Siphon never sees card numbers |
| Healthchecks.io | Alerts to Siphon's operator when imports fail or pause | Import names, tab names and IDs; no report data and no email addresses |
Security contact
Found a problem? Tell us directly.
Security reports go straight to engineering. Include what you found and how to reproduce it. Please don't test against other customers' data.