Built like money
depends on it.

Your shop's data is yours alone

Every query on tenant data is scoped to your shop as an enforced invariant, not a convention. A guard layer flags any unscoped access, and gateway lookups are compound-keyed to the shop so one store's webhook can never touch another store's records.

Secrets stay secret

Razorpay keys, webhook secrets and Shopify tokens are stored AES-256-GCM encrypted and shown masked in the admin. Card and UPI credentials never touch Hooked — payment instruments live with Razorpay and Shopify.

Every entry point is verified

• Admin API: Shopify session tokens (signed JWTs), verified per request.
• Webhooks: HMAC signatures verified with timing-safe comparison.
• Storefront: Shopify app-proxy signatures identify the shop and the logged-in customer cryptographically.
• Customer portal: HMAC-signed, expiring tokens; referrer leakage blocked.

Correctness the database enforces

• Idempotency keys on webhooks — retries can never double-charge or double-ship.
• Subscription provisioning runs in single database transactions.
• Cycle uniqueness is a database constraint, not application logic.
• Order totals equal payments exactly — paisa arithmetic is unit-tested.

Failures repair themselves

Failed webhooks retry with capped attempts. Recovery jobs rebuild missing orders. Rate limiting is enforced across all workers. Health probes report database connectivity so the platform can react before customers notice.

An audit trail for everything

Every material action — webhook processed, cycle skipped, subscription paused, order created, setting changed — is written to an audit log with its actor and timestamp. GDPR endpoints handle customer data requests, customer redaction and shop redaction.