Security & Incident Response

1. Data we hold

From Shopify we read only customer name, email and address, plus products and orders — the minimum needed to track subscriptions and recommend each subscriber's next box. We do not request phone numbers, and we never sell personal data or use it for advertising.

2. Encryption

• In transit: all traffic uses TLS; plain HTTP is redirected.
• At rest: the database is encrypted with InnoDB transparent data encryption (AES-256), including redo, undo and binary logs. The master key is held in a keyring separate from the data files.
• Secrets: Shopify access and refresh tokens and API secrets are additionally encrypted at the application layer.
• Backups: nightly database backups are encrypted with AES-256 before they are written, and are kept for 14 days.

3. Access control

• Only designated administrators can reach the internal admin panel; every other account is refused.
• Staff passwords must be at least 12 characters with upper- and lower-case letters and numbers, and are checked against known breached passwords.
• Every view or change of customer personal data — in the admin panel, the embedded Shopify app and our API — is recorded in an access log (who, what, when, from where). Access logs are kept for one year.
• Merchants only ever see their own store's data; access is scoped by a verified Shopify session token on every request.

4. Data loss prevention

• Encrypted backups run nightly and before every deployment, and each backup is verified complete before it is kept. The encryption key needed to read the database is backed up alongside it, also encrypted.
• Test and development environments use separate databases and fabricated data; production data is never copied into them.
• Data is retained only while a merchant uses CoreAttend. Customer data is deleted on Shopify's customers/redact request, and all of a store's data 48 hours after uninstall (shop/redact).

5. Incident response

If we suspect personal data has been accessed, changed or lost without authorisation:

1. Contain — immediately revoke affected credentials and tokens, block the access path, and preserve logs.
2. Assess — use the access log and server logs to establish what data, which merchants and which customers are affected, and how.
3. Notify — tell affected merchants and Shopify without undue delay, and in any case within 72 hours of becoming aware, with what happened, what data is involved and what we are doing. We support merchants in notifying their customers and regulators where the law requires it.
4. Recover — fix the root cause, restore from encrypted backups if data was lost or altered, and rotate any secret that may have been exposed.
5. Review — write up the incident and the changes made to prevent a repeat, and share the summary with affected merchants.

6. Reporting a security issue

Email radzikowski@gmail.com with details. We acknowledge reports within two business days.