datewise/SECURITY.md

Datewise security and incident response policy

Owner: Metatroncube Software Solutions · Contact: info@metatroncubesolutions.com · Last reviewed: 2026-10-14

Data we hold

Shop settings and scheduling rules; bookings (order ID and number, method, location, date, time, items); customers' name, email, phone and delivery address for reminders and driver run sheets; waitlist emails and phone numbers. Merchant Twilio / WhatsApp credentials when connected.

Data protection

• In transit: HTTPS only (TLS at Nginx or Caddy).
• At rest: customer name, email, phone and address (bookings and waitlist) and messaging credentials are encrypted with AES-256-GCM in the application before they reach the database (app/lib/pii.server.ts). Email and phone lookups use HMAC-SHA256 keyed hashes. The key (APP_ENCRYPTION_KEY) lives only in the server's .env and the team password manager.
• Backups: nightly pg_dump, encrypted with AES-256 (scripts/backup.sh), kept 14 days.
• Minimisation: postal codes typed into the cart are used for zone lookup and not stored with identity.
• Retention: customer redaction requests clear that customer's details from bookings and delete their waitlist entries; all shop data is deleted 48 hours after uninstall (shop/redact).
• Test and production are separate: development uses local databases and Shopify development stores.

Access control

• Production access (VPS, database, Shopify Partner/Dev Dashboard) is limited to named staff who need it.
• SSH uses key-based login; Shopify and Git accounts use strong unique passwords and two-factor authentication.
• Secrets (.env: Shopify secret, database password, APP_ENCRYPTION_KEY) are never stored in Git or chat. Rotate them when someone with access leaves (the encryption key needs a re-encryption step; see below).
• Access is reviewed every quarter.
• Access logging: every time staff list, open or export bookings, or open a driver run sheet, the app records who, what and when (DataAccessLog, kept 12 months, deleted with the shop). Server access is logged by the host (SSH auth log).

Incident response

1. Detect and contain (immediately): revoke exposed credentials, rotate secrets, block the access path, take the affected service offline if needed.
2. Assess (within 24 h): what data, which shops, how many records, time window. Preserve logs.
3. Notify (within 72 h of becoming aware): affected merchants by email, and Shopify via the Partner support channel; regulators where the law requires it.
4. Recover: fix the root cause, restore from encrypted backups if needed, verify.
5. Review (within 2 weeks): written post-mortem, follow-up actions, update this policy.

Key rotation

Changing APP_ENCRYPTION_KEY makes existing ciphertext unreadable. To rotate: deploy with both keys, re-encrypt rows with a one-off script, then remove the old key. Never change the key on its own.