# Offerlyst security and incident response policy

Owner: Metatroncube Software Solutions · Contact: info@metatroncubesolutions.com · Last reviewed: 2026-10-14

## Data we hold
Shop settings, offers, and for analytics: order ID (keyed hash + AES-256-GCM), order number (AES-256-GCM),
order total and discount. No customer names, emails, phone numbers or addresses.

## Access control
- Production access (VPS, database, Shopify Partner/Dev Dashboard) is limited to named staff who need it.
- SSH uses key-based login; Shopify and Git accounts use strong unique passwords and two-factor authentication.
- Secrets (`.env`: Shopify secret, database password, `DATA_ENCRYPTION_KEY`) live only on the server and in the
  team password manager, never in Git or chat. Rotate them when someone with access leaves.
- Access is reviewed every quarter.

## Data protection
- In transit: HTTPS only (TLS at Nginx). At rest: order identifiers encrypted in the database; nightly backups
  encrypted with AES-256 (`scripts/backup.sh`), kept 14 days.
- Test and production are separate: development uses local databases and Shopify development stores.
- Shop data is deleted 48 hours after uninstall (`shop/redact`).

## Incident response
1. **Detect and contain** (immediately): revoke exposed credentials, rotate secrets, block the access path,
   take the affected service offline if needed.
2. **Assess** (within 24 h): what data, which shops, how many records, time window. Preserve logs.
3. **Notify** (within 72 h of becoming aware): affected merchants by email, and Shopify via the Partner
   support channel; regulators where the law requires it.
4. **Recover**: fix the root cause, restore from encrypted backups if needed, verify.
5. **Review** (within 2 weeks): written post-mortem, follow-up actions, update this policy.